This hunt targets the presence of known IOCs associated with the PHP Shin webshell, a tool frequently deployed by adversaries to establish persistent backdoor access and execute arbitrary commands on compromised web servers. Proactively hunting for these indicators in Azure Sentinel is critical to identify stealthy footholds that may have been introduced through vulnerable applications or file upload mechanisms before they are leveraged for lateral movement or data exfiltration.
Malware Family: php.shin_webshell Total IOCs: 7 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | peralaca.workers.dev | botnet_cc | 2026-09-14 | 50% |
| domain | 522warm.workers.dev | botnet_cc | 2026-09-14 | 50% |
| domain | ninedo.workers.dev | botnet_cc | 2026-09-14 | 50% |
| domain | 208certain.workers.dev | botnet_cc | 2026-09-14 | 50% |
| domain | fepavowa.workers.dev | botnet_cc | 2026-09-14 | 50% |
| domain | xbktm00536.workers.dev | botnet_cc | 2026-09-14 | 50% |
| domain | eoqsp45536.workers.dev | botnet_cc | 2026-09-14 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["peralaca.workers.dev", "522warm.workers.dev", "ninedo.workers.dev", "208certain.workers.dev", "fepavowa.workers.dev", "xbktm00536.workers.dev", "eoqsp45536.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
php.shin_webshell or similar lightweight shells (like c99 or b374k) into staging or development environments to facilitate quick debugging, file uploads, or database access via a web interface.
/wp-content/plugins/, /wp-includes/, or /dev/ directories, or where the host is tagged with env:staging or env:dev in your CMDB.debug.php, test.php, or support.php) into the web root to execute specific commands, check file permissions, or verify server connectivity during a ticket resolution process.
IT-Support or Vendor-Admin AD group./backup/, /archive/, /vault/) or where the parent process is a known backup agent executable (e.g., vssadmin.exe, commvault.exe, rsync).