This hunt targets the presence of known IOCs associated with the php.shin_webshell, a malicious PHP script often used by attackers to establish persistent access and execute arbitrary commands on web servers. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised web assets before the adversary leverages the webshell for lateral movement or data exfiltration.
Malware Family: php.shin_webshell Total IOCs: 14 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | everyday1297.workers.dev | botnet_cc | 2026-09-13 | 50% |
| domain | qelusa.workers.dev | botnet_cc | 2026-09-13 | 50% |
| domain | jakatyme.workers.dev | botnet_cc | 2026-09-13 | 50% |
| domain | ljnbk45756.workers.dev | botnet_cc | 2026-09-13 | 50% |
| domain | cawatuve.workers.dev | botnet_cc | 2026-09-13 | 50% |
| domain | bumoxa.workers.dev | botnet_cc | 2026-09-13 | 50% |
| domain | syycs77596.workers.dev | botnet_cc | 2026-09-13 | 50% |
| domain | cohibipy.workers.dev | botnet_cc | 2026-09-13 | 50% |
| domain | eldestvalerie.workers.dev | botnet_cc | 2026-09-13 | 50% |
| domain | ue4dgglt0t.workers.dev | botnet_cc | 2026-09-13 | 50% |
| domain | bomyhego.workers.dev | botnet_cc | 2026-09-13 | 50% |
| domain | tibexoda.workers.dev | botnet_cc | 2026-09-12 | 50% |
| domain | kududuzy.workers.dev | botnet_cc | 2026-09-12 | 50% |
| domain | jeqawoha.workers.dev | botnet_cc | 2026-09-12 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["everyday1297.workers.dev", "qelusa.workers.dev", "jakatyme.workers.dev", "ljnbk45756.workers.dev", "cawatuve.workers.dev", "bumoxa.workers.dev", "syycs77596.workers.dev", "cohibipy.workers.dev", "eldestvalerie.workers.dev", "ue4dgglt0t.workers.dev", "bomyhego.workers.dev", "tibexoda.workers.dev", "kududuzy.workers.dev", "jeqawoha.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
index.php or similar in the /tmp or /var/www/html directories to test upload functionality or debug session handling.
/tmp, /var/tmp, or specific known staging directories (e.g., /var/www/staging) unless the file size exceeds a certain threshold (e.g., > 5KB) or contains specific high-entropy strings.a.php, b.php) during the build stage before they are moved to the production server.
/workspace, /builds, /tmp/ci-artifacts) or exclude events where the parent process is a known CI agent binary (e.g., java, node, docker-cli).cron job that runs a PHP script to clean up old log files or rotate sessions. This script might be stored in a non-standard location (e.g., /opt/scripts/cleanup.php) or use a generic name that overlaps with the IOCs.
root or www-data user and are located in standard script directories (e.g., /opt/scripts, /usr/local/bin) and have not been modified in the last 30 days.