ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the deployment of the php.shin_webshell backdoor to establish persistent access and execute arbitrary commands on compromised web servers. Proactively hunting for these specific IOCs in Azure Sentinel is critical because this webshell often serves as an initial foothold for attackers, enabling them to pivot laterally or exfiltrate sensitive data before traditional alerts trigger.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 11 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["tucixuno.workers.dev", "plmij61000.workers.dev", "boholunu.workers.dev", "jkx26l5rhe.workers.dev", "jpnxh85169.workers.dev", "fysyqudi.workers.dev", "bywajyly.workers.dev", "maitilde72.workers.dev", "cowahu.workers.dev", "vizuku.workers.dev", "senaby.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — php.shin_webshell

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: php.shin_webshell detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Backup of Web Root Directories

  • Context: Enterprise backup agents (e.g., Veeam, Commvault) or custom PowerShell scripts periodically scan the C:\inetpub\wwwroot directory to archive web content. These processes often instantiate temporary PHP instances or parse .php files within the web root that match the file hash signatures of the Shin Webshell IOCs.
  • Filter/Exclusion: Exclude alerts where the process name is a known backup agent (e.g., vbr.exe, commvault_agent.exe) and the parent process is a scheduled task (svchost.exe or TaskScheduler). Add a filter: ProcessName IN ('vbr.exe', 'commvault_agent.exe') AND ParentProcessName = 'svchost.exe'.

• Scenario: CI/CD Pipeline Deployment Artifacts

  • Context: During deployment windows, DevOps tools like Jenkins or Azure DevOps Agents extract and stage application artifacts. The build agents often unzip or copy .php files containing the Shin Webshell signature into a temporary staging directory before moving them to production IIS servers. This triggers the detection logic on the staging server rather than the live web server.
  • Filter/Exclusion: Create an exclusion for file paths located in CI/CD staging directories (e.g., C:\Jenkins\workspace, D:\AzureDevOps\Staging). Filter: FilePath STARTS WITH 'C:\Jenkins' OR FilePath STARTS WITH 'D:\AzureDevOps'.

• Scenario: Third-Party CMS Plugin Updates

  • Context: Organizations running WordPress, Drupal, or Magento often have automated