ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the php.shin_webshell web shell, a tool frequently used by threat actors to establish persistent access and execute commands on compromised PHP-based servers. A SOC team should proactively search for these specific IOCs in Azure Sentinel because early identification of this web shell can prevent lateral movement and data exfiltration before the adversary fully establishes control over the environment.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["qibanopy.workers.dev", "iritageneral.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — php.shin_webshell

False Positive Guidance

Here are 5 specific false positive scenarios and their corresponding filters/exclusions for the ThreatFox: php.shin_webshell IOCs rule in an enterprise environment:

• Scenario: Automated Web Server Patching via Configuration Management

  • Context: Enterprise DevOps teams use tools like Ansible, Puppet, or Chef to deploy updates to web servers. During a scheduled nightly patch window, these agents may download and extract PHP framework components that contain the specific hash signatures identified as php.shin_webshell (e.g., standard library files or updated core modules).
  • Filter/Exclusion: Create an exclusion based on the Process Name (ansible-runner.exe, puppet-agent.exe) and Source IP. Exclude alerts where the parent process is a known configuration management tool running during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: CI/CD Pipeline Artifact Deployment

  • Context: The organization’s Continuous Integration/Continuous Deployment pipeline (using Jenkins, GitLab CI, or Azure DevOps) builds and deploys new application versions. The deployment script often copies a standard PHP runtime environment to the staging or production IIS/Apache servers, triggering the IOC match on the newly uploaded index.php or framework files.
  • Filter/Exclusion: Implement a filter that excludes alerts originating from specific Deployment Service Accounts (e.g., svc-deploy-jenkins) and restricts detection to non-standard directories. If the file path is within the standard application root (e.g., C:\inetpub\wwwroot\AppName\), suppress the alert unless it appears in a temporary or unexpected directory like C:\Windows\System32.

• Scenario: Scheduled Backup and Archiving Operations

  • **Context