This detection rule identifies adversary behavior involving the deployment of the php.shin_webshell backdoor to establish persistent access and execute arbitrary commands on compromised web servers. SOC teams should proactively hunt for these specific IOCs in Azure Sentinel because this high-severity threat enables attackers to maintain a covert foothold, facilitating lateral movement and data exfiltration that often evades standard signature-based defenses.
Malware Family: php.shin_webshell Total IOCs: 28 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | moqyhy.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | kedyqyle.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | puwyf38278.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | boujy17296.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | fvmko63646.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | sehulopo.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | ubbaw78979.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | ziquli.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | ardisj1944.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | fylehasy.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | nyvivari.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | nevoduby.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | sululuty.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | qemamefy.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | pinkfat.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | f6zw6i5fdy.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | 3ppu1zomp8.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | jecahuma.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | lovuhali.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | vujusisu.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | gelavy.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | dntaa93064.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | eyfykhxq7s.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | hwoxu80469.workers.dev | botnet_cc | 2026-08-28 | 50% |
| domain | xumujepu.workers.dev | botnet_cc | 2026-08-28 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["moqyhy.workers.dev", "kedyqyle.workers.dev", "puwyf38278.workers.dev", "boujy17296.workers.dev", "fvmko63646.workers.dev", "sehulopo.workers.dev", "ubbaw78979.workers.dev", "ziquli.workers.dev", "ardisj1944.workers.dev", "fylehasy.workers.dev", "nyvivari.workers.dev", "nevoduby.workers.dev", "sululuty.workers.dev", "qemamefy.workers.dev", "pinkfat.workers.dev", "f6zw6i5fdy.workers.dev", "3ppu1zomp8.workers.dev", "jecahuma.workers.dev", "lovuhali.workers.dev", "vujusisu.workers.dev", "gelavy.workers.dev", "dntaa93064.workers.dev", "eyfykhxq7s.workers.dev", "hwoxu80469.workers.dev", "xumujepu.workers.dev", "xigetybu.workers.dev", "vilefinu.workers.dev", "ksiyv72370.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: php.shin_webshell detection rule in an enterprise environment:
Scenario: Automated CI/CD Pipeline Deployment
svc-deploy) downloads and extracts PHP source code artifacts into the web server’s document root (/var/www/html). If the build process includes a generic index.php or similar script that matches the Shin Webshell signature, it triggers an alert.jenkins-master-01) and the Process Name is the build agent binary (e.g., java.exe or docker-entrypoint.sh). Additionally, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC).Scenario: Scheduled Backup and Archiving Jobs
.php files that contain byte patterns identical to the Shin Webshell IOCs. This is particularly common when backing up legacy applications with embedded scripts.VeeamBackupService.exe, rubrik-agent) and the File Path residing within the backup staging area or the specific web root directory. Exclude events where the action is “Read” rather than “Write” or “Execute.”