ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hypothesis targets the presence of the php.shin_webshell, a high-severity backdoor that enables remote code execution and persistent access to Azure environments. Proactively hunting for these IOCs is critical to identify compromised web servers before adversaries leverage the webshell to establish footholds, exfiltrate sensitive data, or pivot deeper into the network.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 4 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	`vivyqyxi.workers.dev`	botnet_cc	2026-09-26	50%
domain	`kojexala.workers.dev`	botnet_cc	2026-09-26	50%
domain	`dahawetu.workers.dev`	botnet_cc	2026-09-26	50%
domain	`iy1wc825fz.workers.dev`	botnet_cc	2026-09-26	50%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["vivyqyxi.workers.dev", "kojexala.workers.dev", "dahawetu.workers.dev", "iy1wc825fz.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — php.shin_webshell

False Positive Guidance

Legacy PHP Application Maintenance: Developers or DevOps engineers may deploy custom, unversioned PHP scripts (e.g., maintenance.php, debug.php) to legacy web servers for temporary task execution or data migration. These scripts often contain raw system() or exec() calls that match the behavioral signature of the webshell.
- Filter/Exclusion: Exclude files located in specific development or staging directories (e.g., /var/www/html/dev/, /opt/legacy-app/tmp/) or allowlist known maintenance scripts by their exact SHA256 hash and file path.
CI/CD Pipeline Artifacts: Automated build pipelines (using Jenkins, GitLab CI, or GitHub Actions) may generate temporary PHP entry points or test harnesses on build agents or ephemeral containers. If these agents are not fully ephemeral or if logs are retained, the presence of a PHP file with executable logic in a non-standard directory can trigger the rule.
- Filter/Exclusion: Exclude detections on hosts tagged as build-agent or ci-runner in your CMDB, or filter out files created within the last 15 minutes on containers that are scheduled for termination.
Third-Party Plugin Updates: Enterprise CMS platforms (like WordPress, Drupal, or Joomla) often rely on third-party plugins that include PHP files for integration with external services (e.g., payment gateways, analytics). A plugin update might introduce a new PHP file with a name or structure similar to known webshell IOCs (e.g., class.php, util.php).
- Filter/Exclusion: Correlate the detection with recent package manager logs (e.g., composer install or wp-cli logs) and exclude files within the /wp-content/plugins/ or /modules/ directories if the file timestamp aligns with a known plugin update event.