ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of the php.shin_webshell backdoor by matching network and host logs against a curated set of 27 specific Indicators of Compromise (IOCs). A SOC team should proactively hunt for this threat in Azure Sentinel to identify early-stage web shell infections that often evade standard signature-based detection, thereby preventing potential lateral movement and data exfiltration.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 27 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	fukokuto.workers.dev	botnet_cc	2026-08-31	50%
domain	xuliluma.workers.dev	botnet_cc	2026-08-31	50%
domain	hbupgtkx49.workers.dev	botnet_cc	2026-08-31	50%
domain	cw91bzc2fb.workers.dev	botnet_cc	2026-08-31	50%
domain	dvtwn44396.workers.dev	botnet_cc	2026-08-31	50%
domain	es0jh7f31p.workers.dev	botnet_cc	2026-08-31	50%
domain	krbst56779.workers.dev	botnet_cc	2026-08-31	50%
domain	4402inherent.workers.dev	botnet_cc	2026-08-31	50%
domain	leriqilu.workers.dev	botnet_cc	2026-08-31	50%
domain	ycphj84084.workers.dev	botnet_cc	2026-08-31	50%
domain	pyremy.workers.dev	botnet_cc	2026-08-31	50%
domain	ira240.workers.dev	botnet_cc	2026-08-31	50%
domain	xiviju.workers.dev	botnet_cc	2026-08-31	50%
domain	pumykuja.workers.dev	botnet_cc	2026-08-31	50%
domain	zedypyqi.workers.dev	botnet_cc	2026-08-31	50%
domain	pujavi.workers.dev	botnet_cc	2026-08-31	50%
domain	hafagu-ce1.workers.dev	botnet_cc	2026-08-31	50%
domain	xesevy.workers.dev	botnet_cc	2026-08-31	50%
domain	duvokufi.workers.dev	botnet_cc	2026-08-31	50%
domain	fyhoqo.workers.dev	botnet_cc	2026-08-31	50%
domain	yhztr74434.workers.dev	botnet_cc	2026-08-31	50%
domain	dixibahy.workers.dev	botnet_cc	2026-08-31	50%
domain	muziwawy.workers.dev	botnet_cc	2026-08-31	50%
domain	vyivy22522.workers.dev	botnet_cc	2026-08-31	50%
domain	fyjilowu.workers.dev	botnet_cc	2026-08-31	50%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["fukokuto.workers.dev", "xuliluma.workers.dev", "hbupgtkx49.workers.dev", "cw91bzc2fb.workers.dev", "dvtwn44396.workers.dev", "es0jh7f31p.workers.dev", "krbst56779.workers.dev", "4402inherent.workers.dev", "leriqilu.workers.dev", "ycphj84084.workers.dev", "pyremy.workers.dev", "ira240.workers.dev", "xiviju.workers.dev", "pumykuja.workers.dev", "zedypyqi.workers.dev", "pujavi.workers.dev", "hafagu-ce1.workers.dev", "xesevy.workers.dev", "duvokufi.workers.dev", "fyhoqo.workers.dev", "yhztr74434.workers.dev", "dixibahy.workers.dev", "muziwawy.workers.dev", "vyivy22522.workers.dev", "fyjilowu.workers.dev", "rlltn52176.workers.dev", "cenoci.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — php.shin_webshell

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: php.shin_webshell detection rule in an enterprise environment:

• Scenario: Automated Backup Scripts Executing Web Shell Artifacts

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize PHP scripts to manage web-based dashboards or generate reports. These scripts may contain file hashes or network connection patterns that match the php.shin_webshell IOCs, particularly if the backup agent runs a local web server component.
  • Filter/Exclusion: Exclude processes originating from known backup service accounts (e.g., NT SERVICE\VeeamTransportService) and restrict detection to files located outside of standard application directories like \Program Files\Commvault or \Veeam.

• Scenario: DevOps CI/CD Pipeline Deployments

  • Context: During continuous integration and deployment cycles using tools like Jenkins, GitLab Runner, or Azure DevOps, build agents frequently instantiate temporary PHP containers to test web application components. These transient instances often load standard libraries that trigger the IOCs associated with php.shin_webshell during the “Build” or “Integration Test” phases.
  • Filter/Exclusion: Create an exclusion based on the hostname pattern of build agents (e.g., *jenkins-agent-*, *gitlab-runner-*) and limit alerts to business hours or specific deployment windows defined in the orchestration tool’s schedule.

• Scenario: Internal Knowledge Base or CMS Maintenance Jobs

  • Context: Scheduled maintenance jobs for internal Content Management Systems (e.g., WordPress, Drupal, or custom PHP-based portals) often run nightly cron tasks that update plugins, clear caches, or regenerate sitemaps. These legitimate administrative tasks involve executing PHP scripts with network connectivity profiles identical to the webshell IOCs.