ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the deployment of a PHP Shin webshell to establish persistence and execute arbitrary commands on compromised web servers. The SOC team should proactively search for these specific IOCs in Azure Sentinel to identify early-stage web application compromises that could lead to lateral movement or data exfiltration before they escalate into broader incidents.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["zefybeky.workers.dev", "bogawacu.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — php.shin_webshell

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: php.shin_webshell detection rule in an enterprise environment:

• Scenario: Automated Web Server Maintenance Scripts

  • Context: DevOps teams often deploy automated maintenance scripts using cron jobs or Windows Task Scheduler to update PHP configurations, clear cache directories, or rotate logs on web servers (e.g., Apache/Nginx running PHP-FPM). These scripts may temporarily instantiate a php.shin_webshell process to perform health checks or configuration validation.
  • Filter/Exclusion: Create an exclusion rule that ignores alerts where the parent process is a known scheduler service (e.g., crond, systemd, or Task Scheduler) AND the file path resides within a designated maintenance directory (e.g., /var/www/maintenance/ or C:\inetpub\scripts\).

• Scenario: CI/CD Pipeline Deployment Artifacts

  • Context: During Continuous Integration/Continuous Deployment (CI/CD) cycles, tools like Jenkins, GitLab Runner, or GitHub Actions execute deployment pipelines. These agents often pull and stage PHP web application artifacts that include the shin_webshell component as part of the standard application bundle before the final production rollout.
  • Filter/Exclusion: Exclude events where the execution host is a known CI/CD runner node (identified by hostname regex like *-runner-01) or where the process user is a dedicated service account (e.g., jenkins, gitlab-runner, or deploy-bot).

• Scenario: Third-Party Application Updates via Control Panel

  • Context: Enterprise environments frequently utilize web hosting control panels like cPanel, Plesk, or custom internal portals. When an administrator clicks “Update” or “Check Status” on a specific PHP application within these dash