ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This detection identifies adversary activity involving the deployment of a PHP Shin webshell to establish persistent access and execute commands on compromised web servers. A SOC team should proactively hunt for this behavior in Azure Sentinel because webshells are frequently used as an initial foothold for lateral movement and data exfiltration, requiring immediate investigation to prevent broader network compromise.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["uz7mn8jcpt.workers.dev", "xorajahy.workers.dev", "dujexi.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — php.shin_webshell

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: php.shin_webshell detection rule in an enterprise environment:

• Scenario: Legitimate deployment of a new PHP-based internal dashboard or customer portal by the DevOps team using CI/CD pipelines (e.g., Jenkins, GitLab CI). The pipeline creates temporary .php files containing standard webshell-like signatures during the build and artifact staging phase.

  • Filter/Exclusion: Exclude alerts where the source process is a known CI/CD agent (e.g., jenkins-agent.exe, gitlab-runner) or where the file creation path falls within designated deployment directories (e.g., C:\Deployments\Staging\ or /var/www/html/staging/).

• Scenario: Automated backup and archiving jobs running on web servers that utilize PHP scripts to generate daily status reports or log summaries. These scheduled tasks often instantiate temporary .php files in the root directory that match the IOCs of a Shin Webshell due to similar code structures (e.g., system() calls for logging).

  • Filter/Exclusion: Create an exclusion based on the parent process being a known scheduler service (e.g., Task Scheduler, cron) and restrict the scope to files created during specific maintenance windows (e.g., 02:00–04:00 UTC) or within backup-specific subdirectories.

• Scenario: Security administrators performing manual vulnerability assessments using web-based scanning tools (e.g., Qualys, Tenable Nessus) that inject test PHP scripts into the web root to verify server configurations and upload capabilities.

  • Filter/Exclusion: Filter out alerts where the user account initiating the file creation belongs to a specific “Security_Audit” or “Admin_External” group, and the file name contains standard testing prefixes (e.g., `test_