ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hunt targets the presence of known PHP Shin webshell indicators, which adversaries deploy to establish persistent, stealthy command-and-control access to compromised web servers. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets before the webshell is leveraged for lateral movement or data exfiltration.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 6 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	`wrkmb21091.workers.dev`	botnet_cc	2026-09-08	50%
domain	`welypubo.workers.dev`	botnet_cc	2026-09-08	50%
domain	`witani.workers.dev`	botnet_cc	2026-09-08	50%
domain	`muzeqoci.workers.dev`	botnet_cc	2026-09-08	50%
domain	`qiqarife.workers.dev`	botnet_cc	2026-09-08	50%
domain	`vc4625eicq.workers.dev`	botnet_cc	2026-09-08	50%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["wrkmb21091.workers.dev", "welypubo.workers.dev", "witani.workers.dev", "muzeqoci.workers.dev", "qiqarife.workers.dev", "vc4625eicq.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — php.shin_webshell

False Positive Guidance

Legacy PHP Application Maintenance: A web developer updates a legacy content management system (e.g., WordPress or Joomla) that uses the shin framework or a custom plugin relying on the specific file structure or hash signatures of the php.shin_webshell. The IOC matches a legitimate library file (e.g., shin.php or a specific class file) rather than the malicious payload.
- Filter/Exclusion: Exclude files located in known vendor directories (e.g., /wp-content/plugins/*/lib/ or /vendor/shin/) and allow specific file hashes if they are part of a signed, version-controlled repository.
CI/CD Pipeline Artifact Scanning: The enterprise CI/CD pipeline (e.g., Jenkins, GitLab CI, or Azure DevOps) runs static analysis or binary scanning tools (e.g., Trivy, Snyk, or ClamAV) on build artifacts. These tools may temporarily write IOC-matching files to a scratch directory or cache folder during the scan process, triggering the detection.
- Filter/Exclusion: Exclude paths associated with CI/CD agent workspaces (e.g., /var/lib/jenkins/workspace/, /tmp/ci-cache/, or .gitlab-runner/) and exclude processes initiated by the CI/CD agent service account.
Security Tooling and IOC Staging: SOC or DevSecOps teams stage the php.shin_webshell IOCs in a local directory (e.g., C:\Tools\IOCs\ or /opt/security/iocs/) for testing, documentation, or integration with threat intelligence platforms (e.g., MISP, TheHive, or Cortex). The detection rule flags these staging files as active threats.
- Filter/Exclusion: Exclude files in designated security tooling directories (e.g., C:\Tools\, `/opt