This detection identifies adversary activity involving the deployment of a PHP Shin webshell, which attackers utilize to establish persistent command-and-control channels and execute arbitrary commands on compromised web servers. A SOC team should proactively hunt for this behavior in Azure Sentinel to rapidly identify and isolate infected hosts before adversaries leverage the webshell for lateral movement or data exfiltration across the organization’s network.
Malware Family: php.shin_webshell Total IOCs: 23 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | zalupifu.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | negimegy.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | lalaqovy.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | wyxubece.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | javebuxo.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | wcxme67917.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | amn00kh0pe.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | gtxam54079.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | qykuba.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | pofoga.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | uwkac56907.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | hojaheno.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | cbuod47726.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | 0hqrb19cyv.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | rucequ.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | 480peumx1e.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | vogebene.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | 26seodg1pp.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | puhihylo.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | kevyn94.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | gezajoqa.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | dawelyxi.workers.dev | botnet_cc | 2026-09-01 | 50% |
| domain | nwuor63200.workers.dev | botnet_cc | 2026-09-01 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["zalupifu.workers.dev", "negimegy.workers.dev", "lalaqovy.workers.dev", "wyxubece.workers.dev", "javebuxo.workers.dev", "wcxme67917.workers.dev", "amn00kh0pe.workers.dev", "gtxam54079.workers.dev", "qykuba.workers.dev", "pofoga.workers.dev", "uwkac56907.workers.dev", "hojaheno.workers.dev", "cbuod47726.workers.dev", "0hqrb19cyv.workers.dev", "rucequ.workers.dev", "480peumx1e.workers.dev", "vogebene.workers.dev", "26seodg1pp.workers.dev", "puhihylo.workers.dev", "kevyn94.workers.dev", "gezajoqa.workers.dev", "dawelyxi.workers.dev", "nwuor63200.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are the false positive scenarios and corresponding exclusions for the ThreatFox: php.shin_webshell detection rule:
Scenario: Scheduled Backup or Migration Scripts Executing PHP Artifacts
.php files in the webroot directory that match the hash signatures of the Shin Webshell IOCs during execution windows.vssadmin, commvault_agent) and restrict detection to non-scheduled hours or specific file paths outside of standard backup directories (e.g., exclude \Backup\Staging\).Scenario: Automated CI/CD Pipeline Deployments
jenkins-agent-01, gitlab-runner) or exclude files created within the last 15 minutes of a scheduled deployment window.Scenario: Third-Party CMS Plugin Updates