ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hypothesis targets the presence of known IOCs associated with the PHP Shin webshell, indicating that an adversary has likely established a persistent foothold within the organization’s web infrastructure to execute arbitrary commands. Proactively hunting for these indicators in Azure Sentinel is critical to identify compromised web servers before attackers leverage the webshell for lateral movement, data exfiltration, or further privilege escalation.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 4 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	`cyculuwy.workers.dev`	botnet_cc	2026-09-24	50%
domain	`foropyqa.workers.dev`	botnet_cc	2026-09-24	50%
domain	`fqoei06069.workers.dev`	botnet_cc	2026-09-24	50%
domain	`helycygu.workers.dev`	botnet_cc	2026-09-24	50%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["cyculuwy.workers.dev", "foropyqa.workers.dev", "fqoei06069.workers.dev", "helycygu.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — php.shin_webshell

False Positive Guidance

Legacy Application Maintenance via sed/awk: Administrators performing in-place text replacements on legacy PHP source code using standard Unix tools like sed or awk may inadvertently create temporary files or modify script headers that match the specific string patterns (e.g., <?php @eval(...) or specific base64 blobs) used by the Shin Webshell.
- Filter/Exclusion: Exclude alerts where the parent process is sed, awk, perl, or python and the file path resides within known legacy application directories (e.g., /var/www/legacy-app/) rather than standard web root entry points like index.php.
CI/CD Pipeline Artifact Staging: In DevOps environments, build agents (e.g., Jenkins, GitLab CI) often stage PHP artifacts in temporary directories before deployment. If the build process involves copying a reference implementation or a test fixture containing the Shin Webshell signature for validation purposes, it can trigger the IOC match in the staging area.
- Filter/Exclusion: Exclude detections where the file path contains /tmp/, /var/tmp/, or .git/ and the parent process is a known CI/CD agent binary (e.g., java for Jenkins, node for GitLab Runner, or docker CLI).
Security Team Red Team/Blue Team Drills: During internal penetration tests or vulnerability assessments, security analysts intentionally deploy the Shin Webshell (or its variants) to verify detection coverage. These files are often placed in isolated test directories or under specific user accounts dedicated to the security team.
- Filter/Exclusion: Exclude alerts where the file owner is a known security service account (e.g., svc-sec-ops, pentest-user) or the file path contains /security-tests/, /redteam/, or `/drills