ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This detection identifies adversary activity involving the deployment of the php.shin_webshell backdoor, which attackers utilize to establish persistent access and execute commands on compromised web servers. Proactively hunting for these specific IOCs within Azure Sentinel is critical because this webshell often serves as an initial foothold that enables lateral movement and data exfiltration before broader detection mechanisms trigger alerts.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 9 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	`lixyvy.workers.dev`	botnet_cc	2026-08-27	50%
domain	`unnecessaryscarlet.workers.dev`	botnet_cc	2026-08-27	50%
domain	`helum66775.workers.dev`	botnet_cc	2026-08-27	50%
domain	`vzz1jq7u8k.workers.dev`	botnet_cc	2026-08-27	50%
domain	`pamevile.workers.dev`	botnet_cc	2026-08-27	50%
domain	`siffx01359.workers.dev`	botnet_cc	2026-08-27	50%
domain	`vhgicwxoo9.workers.dev`	botnet_cc	2026-08-27	50%
domain	`lag11ci2tl.workers.dev`	botnet_cc	2026-08-27	50%
domain	`zynwh37550.workers.dev`	botnet_cc	2026-08-27	50%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["lixyvy.workers.dev", "unnecessaryscarlet.workers.dev", "helum66775.workers.dev", "vzz1jq7u8k.workers.dev", "pamevile.workers.dev", "siffx01359.workers.dev", "vhgicwxoo9.workers.dev", "lag11ci2tl.workers.dev", "zynwh37550.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — php.shin_webshell

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: php.shin_webshell detection rule in an enterprise environment:

Scenario: Automated Backup Scripts Executing Web Shell Artifacts
- Context: Enterprise backup solutions (e.g., Veeam, Commvault) or custom maintenance scripts often deploy temporary PHP files to web servers to facilitate data extraction or status reporting. These scripts may utilize the exact file hash or path structure identified in the php.shin_webshell IOCs as part of their standard deployment routine.
- Filter/Exclusion: Create a whitelist rule excluding alerts where the source process is the backup service executable (e.g., veeam.service.exe, commvault.cmd) and the file path resides within a dedicated maintenance directory (e.g., C:\Program Files\BackupAgent\WebRoot).
Scenario: CI/CD Pipeline Deployment of Known Web Components
- Context: During routine application updates, DevOps pipelines using tools like Jenkins, GitLab CI, or Azure DevOps deploy standard web components to the production IIS/Apache servers. If the php.shin_webshell IOCs represent a common library file used across multiple applications, every deployment triggers the rule.
- Filter/Exclusion: Implement an exclusion based on the “Deployment Agent” identity. Filter out alerts where the parent process is the CI/CD agent (e.g., jenkins-agent.exe, azdo-build-worker) and the file creation timestamp aligns with a scheduled deployment window (e.g., 02:00–04:00 UTC).
Scenario: Security Scanning Tools Generating Temporary PHP Probes
- Context: Vulnerability management tools such as Qualys, Tenable Nessus, or Rapid7 InsightVM often inject temporary PHP scripts into the web server