This hunt identifies the presence of known IOCs associated with the PHP Shin webshell, a tool frequently deployed by adversaries to establish persistent access and execute arbitrary commands on compromised web servers. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to detect stealthy backdoors before they are leveraged for lateral movement or data exfiltration, thereby reducing the dwell time of high-severity threats.
Malware Family: php.shin_webshell Total IOCs: 8 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | 9r3vgn8qt8.workers.dev | botnet_cc | 2026-09-12 | 50% |
| domain | zytacisy.workers.dev | botnet_cc | 2026-09-12 | 50% |
| domain | denice943.workers.dev | botnet_cc | 2026-09-12 | 50% |
| domain | sitynyvu.workers.dev | botnet_cc | 2026-09-12 | 50% |
| domain | sbfjq52806.workers.dev | botnet_cc | 2026-09-12 | 50% |
| domain | rqtpo36930.workers.dev | botnet_cc | 2026-09-12 | 50% |
| domain | qicuzihu.workers.dev | botnet_cc | 2026-09-12 | 50% |
| domain | ujhxw83735.workers.dev | botnet_cc | 2026-09-12 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["9r3vgn8qt8.workers.dev", "zytacisy.workers.dev", "denice943.workers.dev", "sitynyvu.workers.dev", "sbfjq52806.workers.dev", "rqtpo36930.workers.dev", "qicuzihu.workers.dev", "ujhxw83735.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
php.shin_webshell signature (e.g., for legacy compatibility or specific feature support). The file is placed in the /wp-content/plugins/ or /modules/ directory.
*\/plugins\/ or *\/modules\/ where the file owner is the www-data or apache service account and the modification time aligns with a scheduled cron job for plugin updates.rsync or scp from a CI/CD pipeline. The build artifact includes a test utility script that matches one of the 8 IOCs (e.g., a specific base64-encoded string or function name used for debugging).
10.20.0.0/24) and the destination path is under /var/www/staging/ or /tmp/builds/.tar or unzip. The restored files include a known webshell file that was present in the application codebase at the time of backup (perhaps intentionally for a maintenance mode or accidentally included).
tar, unzip, or rsync and exclude file creation events where the parent process is a backup utility and the file age is older than the backup timestamp.