This hunt targets the presence of known PHP Shin webshell indicators on Azure-hosted web servers, which adversaries deploy to establish persistent, stealthy access for executing arbitrary commands. Proactively hunting for these IOCs is critical because webshells often operate silently within the application layer, allowing threat actors to maintain a foothold in the environment and escalate privileges before traditional network-based detections trigger.
Malware Family: php.shin_webshell Total IOCs: 16 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | 6p3ramracc.workers.dev | botnet_cc | 2026-09-20 | 50% |
| domain | lyhawu.workers.dev | botnet_cc | 2026-09-20 | 50% |
| domain | secoqa.workers.dev | botnet_cc | 2026-09-20 | 50% |
| domain | vozuji.workers.dev | botnet_cc | 2026-09-20 | 50% |
| domain | c59azdfvvg.workers.dev | botnet_cc | 2026-09-20 | 50% |
| domain | nobuje.workers.dev | botnet_cc | 2026-09-20 | 50% |
| domain | xehokedu.workers.dev | botnet_cc | 2026-09-20 | 50% |
| domain | uarzw97131.workers.dev | botnet_cc | 2026-09-20 | 50% |
| domain | vetoburo.workers.dev | botnet_cc | 2026-09-20 | 50% |
| domain | wiretofu.workers.dev | botnet_cc | 2026-09-20 | 50% |
| domain | disciplinaryrhody.workers.dev | botnet_cc | 2026-09-20 | 50% |
| domain | mimyfile.workers.dev | botnet_cc | 2026-09-20 | 50% |
| domain | zr54dyn295.workers.dev | botnet_cc | 2026-09-19 | 50% |
| domain | rapesalu.workers.dev | botnet_cc | 2026-09-19 | 50% |
| domain | vaago81750.workers.dev | botnet_cc | 2026-09-19 | 50% |
| domain | bukawomi.workers.dev | botnet_cc | 2026-09-19 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["6p3ramracc.workers.dev", "lyhawu.workers.dev", "secoqa.workers.dev", "vozuji.workers.dev", "c59azdfvvg.workers.dev", "nobuje.workers.dev", "xehokedu.workers.dev", "uarzw97131.workers.dev", "vetoburo.workers.dev", "wiretofu.workers.dev", "disciplinaryrhody.workers.dev", "mimyfile.workers.dev", "zr54dyn295.workers.dev", "rapesalu.workers.dev", "vaago81750.workers.dev", "bukawomi.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
shin.php or similar file in its /wp-includes/ or /lib/ directory for backward compatibility or specific plugin functionality.
/wp-includes/, /vendor/, or specific known library directories (e.g., /node_modules/, /bower_components/) if the IOC matches a known benign file hash or path structure.shin.php or test_shin.php during feature development or bug reproduction, which are not cleaned up before deployment.
environment:staging or environment:dev, or exclude files created within the last 7 days in non-production zones.shin_helper.php) for internal routing or caching purposes.