ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hypothesis targets the presence of known IOCs associated with the PHP Shin webshell, indicating a potential compromise where an adversary has established a persistent foothold to execute arbitrary commands on a web server. Proactively hunting for these indicators in Azure Sentinel is critical because webshells often operate silently to facilitate lateral movement and data exfiltration, making early detection essential to prevent further escalation of privileges within the environment.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["hrwsflkxka.workers.dev", "redsissy.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — php.shin_webshell

False Positive Guidance

• Legacy Application Maintenance via shin Framework: A development team updates a legacy PHP application that relies on the shin framework for dependency management or testing utilities. The composer install or manual script execution downloads the shin package, which may contain the specific IOCs (e.g., specific file hashes or base64-encoded strings) associated with the webshell.

  • Filter/Exclusion: Exclude alerts where the process path matches C:\Program Files\Composer\vendor\shin\ or where the parent process is php.exe or composer.exe and the working directory is within a known application source code folder (e.g., D:\Projects\LegacyApp\vendor\).

• CI/CD Pipeline Artifact Caching: In a DevOps pipeline, a build agent caches PHP dependencies to speed up subsequent builds. The cache directory retains the shin library from a previous build, and a periodic disk cleanup or log rotation job reads these files, triggering the IOC match on the file content or hash.

  • Filter/Exclusion: Exclude events where the file path contains \ci-cache\, \build-artifacts\, or \temp\php\ and the user account is a service account (e.g., svc-ci-build, jenkins-agent).

• Security Testing and Penetration Testing: An internal red team or external vendor performs a penetration test and intentionally deploys the shin webshell to a staging environment to validate detection coverage. The test is scheduled and documented, but the alert fires before the ticket is closed.

  • Filter/Exclusion: Exclude alerts for specific staging IPs (e.g., 10.20.50.0/24) or user accounts tagged with pentest or redteam in AD, provided the event timestamp falls within the approved maintenance