ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This rule detects the presence of the php.shin_webshell, a PHP-based backdoor that grants adversaries remote code execution and full server control to facilitate data exfiltration. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised web servers early, preventing attackers from leveraging the webshell for persistent access and lateral movement within the environment.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 4 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	`amaliafair.workers.dev`	botnet_cc	2026-09-15	50%
domain	`kfypz34545.workers.dev`	botnet_cc	2026-09-15	50%
domain	`oknpx15638.workers.dev`	botnet_cc	2026-09-15	50%
domain	`ttbit94071.workers.dev`	botnet_cc	2026-09-15	50%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["amaliafair.workers.dev", "kfypz34545.workers.dev", "oknpx15638.workers.dev", "ttbit94071.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — php.shin_webshell

False Positive Guidance

Legitimate PHP Development and Testing: Developers or DevOps engineers may deploy custom PHP scripts or test harnesses that mimic webshell behavior (e.g., using eval(), base64_decode(), or dynamic function calls) in staging environments or local development containers.
- Filter/Exclusion: Exclude alerts where the source IP is within the internal development subnet (e.g., 10.20.0.0/16) or where the user agent contains “Postman” or “cURL” and the request path ends in /dev/ or /test/.
CMS Plugin Updates and Maintenance: Popular CMS platforms like WordPress, Joomla, or Drupal often execute PHP code during plugin/theme updates or via maintenance scripts (e.g., wp-cron.php, update.php) that may use obfuscated or dynamic code execution patterns similar to webshells.
- Filter/Exclusion: Exclude alerts if the HTTP User-Agent matches known CMS update agents (e.g., WordPress/6.x, Joomla/4.x) or if the request path matches standard maintenance endpoints like /wp-admin/, /administrator/, or /install/.
Scheduled Backup and Cleanup Jobs: Enterprise servers often run scheduled cron jobs that execute PHP scripts for log rotation, database cleanup, or backup verification. These scripts may use functions like exec(), shell_exec(), or passthru() to interact with the shell, triggering IOCs.
- Filter/Exclusion: Exclude alerts if the process parent is cron or crond, or if the script path resides in standard maintenance directories such as /var/www/html/maintenance/, /opt/scripts/, or /usr/local/bin/.
API Gateway or Load Balancer Health Checks: Some API gateways or load balancers (e.g., NGIN