ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hypothesis targets the deployment of the php.shin_webshell, which adversaries use to establish persistent remote code execution and exfiltrate data from compromised web servers. Proactively hunting for these IOCs in Azure Sentinel is critical to identify unauthorized server-side activity and prevent attackers from leveraging this backdoor for lateral movement or data theft.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 5 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	`uniqueindigo.workers.dev`	botnet_cc	2026-09-28	50%
domain	`lusiko.workers.dev`	botnet_cc	2026-09-28	50%
domain	`sofomy.workers.dev`	botnet_cc	2026-09-28	50%
domain	`qygidyzi.workers.dev`	botnet_cc	2026-09-28	50%
domain	`fivule.workers.dev`	botnet_cc	2026-09-28	50%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["uniqueindigo.workers.dev", "lusiko.workers.dev", "sofomy.workers.dev", "qygidyzi.workers.dev", "fivule.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — php.shin_webshell

False Positive Guidance

Legitimate CMS Plugin Updates: Administrators updating WordPress, Joomla, or Drupal plugins often upload new PHP files to the /wp-content/plugins/ or /modules/ directories. If the update package contains a file matching the specific hash or string pattern of the php.shin_webshell IOC (e.g., a specific base64-encoded payload or unique function name), this triggers the alert.
- Filter/Exclusion: Exclude alerts where the source IP is an internal admin subnet (e.g., 10.0.1.0/24) and the destination path matches known CMS plugin directories (/wp-content/plugins/, /modules/, /components/). Additionally, correlate with the X-Forwarded-For header to confirm the request originated from a known admin workstation.
Scheduled Backup or Sync Jobs: Enterprise environments often use cron jobs or scheduled tasks (e.g., via crontab or Windows Task Scheduler) to synchronize web content between staging and production servers. Tools like rsync or scp may transfer PHP files that contain the same static strings or hashes as the IOCs, especially if the staging environment has a known benign copy of the file.
- Filter/Exclusion: Exclude alerts where the process initiating the file write is a known backup or sync utility (e.g., rsync, scp, python running a backup script) and the user context is a service account (e.g., www-data, backup-service, or svc-sync). Verify the parent process is not a web server process like apache2 or nginx handling an HTTP request.
DevOps CI/CD Pipeline Deployments: Continuous Integration/Continuous Deployment pipelines (e.g., Jenkins, GitLab CI, GitHub Actions) frequently deploy new application code to web servers. If a developer commits a PHP file that coinc