ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hunt targets the presence of known IOCs associated with the php.shin_webshell, a malicious PHP script often used by adversaries to establish persistent access and execute arbitrary commands on compromised web servers. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify and isolate infected assets before the webshell is leveraged for lateral movement or data exfiltration.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 6 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	`towagiwo.workers.dev`	botnet_cc	2026-09-07	50%
domain	`nydivoca.workers.dev`	botnet_cc	2026-09-07	50%
domain	`293juana.workers.dev`	botnet_cc	2026-09-07	50%
domain	`qpa8ujvtfq.workers.dev`	botnet_cc	2026-09-07	50%
domain	`rabinuje.workers.dev`	botnet_cc	2026-09-07	50%
domain	`vuioe33668.workers.dev`	botnet_cc	2026-09-07	50%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["towagiwo.workers.dev", "nydivoca.workers.dev", "293juana.workers.dev", "qpa8ujvtfq.workers.dev", "rabinuje.workers.dev", "vuioe33668.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — php.shin_webshell

False Positive Guidance

Legacy PHP Application Maintenance: An administrator is manually updating or debugging a legacy internal tool (e.g., an old WordPress plugin or custom inventory system) that uses the shin_webshell script for temporary file upload or debugging purposes.
- Filter/Exclusion: Exclude alerts where the source process is a known web server (e.g., httpd.exe, nginx.exe, php-cgi.exe) and the destination path resides within a specific legacy application directory (e.g., C:\inetpub\wwwroot\legacy-app\).
Scheduled Backup or Sync Job: A scheduled task (e.g., via Windows Task Scheduler or cron) runs a PHP script to synchronize configuration files or logs, and the script name or hash matches one of the 6 IOCs because it was copied from a shared repository without renaming.
- Filter/Exclusion: Exclude events where the parent process is svchost.exe (Task Scheduler) or crond/cron (Linux), and the file path contains standard backup or sync directories (e.g., \backups\, \sync\, \logs\).
Development Environment Testing: A developer is testing a new feature in a local staging environment using a known PHP webshell for quick API testing or file manipulation, and the staging server is inadvertently included in the production detection scope.
- Filter/Exclusion: Exclude hosts tagged as env=staging or env=dev in your CMDB or asset inventory, or exclude file paths under standard development directories (e.g., C:\dev\, /home/dev/).
Third-Party Integration Script: A vendor-provided PHP script used for integrating with a SaaS platform (e.g., payment gateway or CRM sync) uses a common utility script that shares a hash or filename with the Shin Webshell IOC.