This hunt hypothesis targets adversaries deploying the php.shin_webshell malware to establish persistence and execute remote commands on compromised web servers, thereby enabling data exfiltration and arbitrary command execution. A proactive search within Azure Sentinel is critical because this threat often masquerades as legitimate administrative tools, making early detection essential to prevent unauthorized access and potential lateral movement before significant data loss occurs.
Malware Family: php.shin_webshell Total IOCs: 76 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | doxise.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | muwlx00405.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | 953sensible.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | tuqewyla.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | cmbhbf32su.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | uuvtq10338.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | xyqulyme.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | z2svmka7bc.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | dorree8903.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | sodyruzu.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | letygoji.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | womose.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | xaucs09664.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | lzoao88779.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | dgs6sfnxy1.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | dozuvime.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | jikiwesi.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | fvqyq70147.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | ekvm8w7naz.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | brd55i3s5p.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | guzory.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | nmnwn42925.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | buwegy.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | wabirana.workers.dev | botnet_cc | 2026-08-29 | 50% |
| domain | chpbj98049.workers.dev | botnet_cc | 2026-08-29 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["doxise.workers.dev", "muwlx00405.workers.dev", "953sensible.workers.dev", "tuqewyla.workers.dev", "cmbhbf32su.workers.dev", "uuvtq10338.workers.dev", "xyqulyme.workers.dev", "z2svmka7bc.workers.dev", "dorree8903.workers.dev", "sodyruzu.workers.dev", "letygoji.workers.dev", "womose.workers.dev", "xaucs09664.workers.dev", "lzoao88779.workers.dev", "dgs6sfnxy1.workers.dev", "dozuvime.workers.dev", "jikiwesi.workers.dev", "fvqyq70147.workers.dev", "ekvm8w7naz.workers.dev", "brd55i3s5p.workers.dev", "guzory.workers.dev", "nmnwn42925.workers.dev", "buwegy.workers.dev", "wabirana.workers.dev", "chpbj98049.workers.dev", "disappointed5249.workers.dev", "banivi.workers.dev", "wowila.workers.dev", "distinct82.workers.dev", "orangeaccessible.workers.dev", "kysefeco.workers.dev", "nadavega.workers.dev", "hneep30685.workers.dev", "jawajacy.workers.dev", "puqc3ya8ik.workers.dev", "nv7oubi9ar.workers.dev", "tisonami.workers.dev", "nivexy.workers.dev", "zarohimu.workers.dev", "syvadone.workers.dev", "qixysyle.workers.dev", "towide.workers.dev", "imcfl38829.workers.dev", "maive55295.workers.dev", "wz84vmk9k0.workers.dev", "qoloroso.workers.dev", "suqyvyxu.workers.dev", "linyse.workers.dev", "l8rdio99d9.workers.dev", "yg8r9mewgv.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: php.shin_webshell IOCs rule, including targeted filters and exclusions tailored for an enterprise environment:
Scenario: Legitimate CMS Plugin Updates via Admin Dashboard
.php files to the wp-content/plugins/ directory that match the signature patterns of the Shin Webshell due to similar code structures and remote execution capabilities.10.x.x.0/24) AND the destination path matches known CMS plugin directories (*/wp-content/plugins/*, */sites/all/modules/*). Additionally, filter out events where the user agent string contains specific admin tool identifiers like Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/....Scenario: Scheduled Backup and Maintenance Scripts
.php artifacts in standard backup folders.backup_*.php, maintenance_*.php, or cron_job_*.php. Ensure the process owner is a dedicated service account (e.g., `svc_backup_admin