ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving the deployment of the php.shin_webshell backdoor, which attackers utilize to establish persistent access and execute arbitrary commands on compromised web servers. Proactive hunting for these specific IOCs within Azure Sentinel is critical to rapidly detect early-stage intrusions before adversaries can escalate privileges or exfiltrate sensitive data through this established foothold.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 13 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	`renellorange.workers.dev`	botnet_cc	2026-09-02	50%
domain	`qmmtr00590.workers.dev`	botnet_cc	2026-09-02	50%
domain	`hadoja.workers.dev`	botnet_cc	2026-09-02	50%
domain	`833gold.workers.dev`	botnet_cc	2026-09-02	50%
domain	`difinese.workers.dev`	botnet_cc	2026-09-02	50%
domain	`s744t74fc1.workers.dev`	botnet_cc	2026-09-02	50%
domain	`juqotida.workers.dev`	botnet_cc	2026-09-02	50%
domain	`xzbu13cl9m.workers.dev`	botnet_cc	2026-09-02	50%
domain	`541lindy.workers.dev`	botnet_cc	2026-09-02	50%
domain	`iuakh13387.workers.dev`	botnet_cc	2026-09-02	50%
domain	`lrfuu94169.workers.dev`	botnet_cc	2026-09-02	50%
domain	`sapphire8825.workers.dev`	botnet_cc	2026-09-02	50%
domain	`bogonewe.workers.dev`	botnet_cc	2026-09-02	50%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["renellorange.workers.dev", "qmmtr00590.workers.dev", "hadoja.workers.dev", "833gold.workers.dev", "difinese.workers.dev", "s744t74fc1.workers.dev", "juqotida.workers.dev", "xzbu13cl9m.workers.dev", "541lindy.workers.dev", "iuakh13387.workers.dev", "lrfuu94169.workers.dev", "sapphire8825.workers.dev", "bogonewe.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — php.shin_webshell

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: php.shin_webshell detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Backup Scripts Executing Web Server Artifacts
- Context: Enterprise backup solutions (e.g., Veeam or Commvault) often run scheduled PowerShell or Bash scripts that iterate through web server directories to archive .php files. If the backup script temporarily downloads or extracts a known shin_webshell sample file for integrity testing, it triggers the IOC match.
- Filter/Exclusion: Exclude processes spawned by the backup service account (e.g., Veeam.Backup.Service.exe, commvault_agent) from the detection logic when the source path is within the designated backup staging directory (C:\BackupStaging\).
Scenario: DevOps CI/CD Pipeline Artifact Deployment
- Context: During automated deployment cycles, tools like Jenkins or GitHub Actions download and unpack container images containing legacy PHP web applications. The php.shin_webshell signature is often embedded within these standard application artifacts as a reference file or dependency, causing the rule to fire upon every successful build.
- Filter/Exclusion: Create an exclusion based on the parent process name (e.g., java.exe, dotnet.exe) and restrict detection to non-build server IP ranges. Alternatively, whitelist specific CI/CD service accounts (e.g., svc-jenkins-deploy) during business hours when deployments are frequent.
Scenario: Security Scanning Tools Performing IOC Verification
- Context: Endpoint Detection and Response (EDR) agents such as CrowdStrike Falcon or Microsoft Defender for Endpoint periodically run “threat emulation” jobs that download known malware samples to a sandbox directory to verify their detection engines. The shin_webshell sample is frequently