This hunt detects adversary behavior involving the deployment of the php.shin_webshell backdoor by matching network and host logs against a curated set of 49 specific Indicators of Compromise (IOCs). Proactive hunting for these signatures in Azure Sentinel is critical to identify early-stage web shell infections that may evade standard signature-based detections, thereby preventing potential lateral movement and data exfiltration.
Malware Family: php.shin_webshell Total IOCs: 49 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | hegitylo.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | yzcza03457.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | zqnro91792.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | gebasaje.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | xylucyzo.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | curly7588.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | bufepy.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | piwola.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | 48dodie.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | gfzatydyf8.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | bixaky.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | cjbwc69441.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | qwxeh11866.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | injured304.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | lyvoha.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | demahapa.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | gawipavy.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | 5462elka.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | significant615.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | levulibo.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | jyxali.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | xutegaje.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | boqoca.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | xuqyzy.workers.dev | botnet_cc | 2026-08-30 | 50% |
| domain | ztsuw61048.workers.dev | botnet_cc | 2026-08-30 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["hegitylo.workers.dev", "yzcza03457.workers.dev", "zqnro91792.workers.dev", "gebasaje.workers.dev", "xylucyzo.workers.dev", "curly7588.workers.dev", "bufepy.workers.dev", "piwola.workers.dev", "48dodie.workers.dev", "gfzatydyf8.workers.dev", "bixaky.workers.dev", "cjbwc69441.workers.dev", "qwxeh11866.workers.dev", "injured304.workers.dev", "lyvoha.workers.dev", "demahapa.workers.dev", "gawipavy.workers.dev", "5462elka.workers.dev", "significant615.workers.dev", "levulibo.workers.dev", "jyxali.workers.dev", "xutegaje.workers.dev", "boqoca.workers.dev", "xuqyzy.workers.dev", "ztsuw61048.workers.dev", "ln20gg35dp.workers.dev", "pamole.workers.dev", "niwosatu.workers.dev", "waducako.workers.dev", "migelabu.workers.dev", "cudww89511.workers.dev", "vtfpy96040.workers.dev", "biqyhiny.workers.dev", "yellingevey.workers.dev", "byrehu.workers.dev", "mo6zthwbal.workers.dev", "kexelado.workers.dev", "y63nxzlm5a.workers.dev", "ksqbbc27ir.workers.dev", "rqytbre182.workers.dev", "wenoty.workers.dev", "gertrudachocolate.workers.dev", "himenuzi.workers.dev", "bubaqupu.workers.dev", "mqa24zcwc6.workers.dev", "shec1y17p3.workers.dev", "vcabw71270.workers.dev", "mbond38982.workers.dev", "gwshh85519.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: Legitimate deployment of the ShinWebShell PHP framework by the DevOps team on the internal web server cluster (web-prod-01) using Ansible automation. The detection triggers because the installation process extracts and executes the specific .php files identified in the IOCs during the initial setup phase.
devops-web-servers AD group and the execution command originates from the Ansible-Service account, specifically filtering for file paths under C:\Inetpub\wwwroot\shinwebshell.Scenario: Scheduled nightly backup job performed by Veeam Backup & Replication agent on the application server. The backup process scans and temporarily loads the ShinWebShell directory structure to verify integrity, causing the detection engine to flag the IOCs as active webshell signatures during the window from 02:00 to 04:00 UTC.
01:30 and 04:30 on weekdays, provided the process name is VeeamAgent.exe and the user context is SYSTEM.Scenario: Routine security audit conducted by the internal compliance team using Tenable Nessus. The scanner performs active probing of the web application layer, which involves parsing and executing specific PHP components to validate configuration baselines against the ShinWebshell IOCs.
Security-Scanners subnet (e.g., 10.20.50.x) and the detected event type is a “File Access” or “Process Creation” initiated by the user Tenable-Sensor.Scenario: Automated content update via Microsoft Endpoint Configuration Manager (SCCM