This hunt targets the presence of known IOCs associated with the PHP Shin webshell, indicating an adversary has likely established a persistent backdoor to execute arbitrary commands on compromised web servers. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify and isolate infected assets before the webshell is leveraged for lateral movement or data exfiltration.
Malware Family: php.shin_webshell Total IOCs: 10 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | lanette592.workers.dev | botnet_cc | 2026-09-21 | 50% |
| domain | zulybefy.workers.dev | botnet_cc | 2026-09-21 | 50% |
| domain | lagigiri.workers.dev | botnet_cc | 2026-09-21 | 50% |
| domain | syrawilu.workers.dev | botnet_cc | 2026-09-21 | 50% |
| domain | fekydi.workers.dev | botnet_cc | 2026-09-21 | 50% |
| domain | jycolano.workers.dev | botnet_cc | 2026-09-21 | 50% |
| domain | y7muyebir6.workers.dev | botnet_cc | 2026-09-21 | 50% |
| domain | yfpdz41265.workers.dev | botnet_cc | 2026-09-21 | 50% |
| domain | 6x45taub7u.workers.dev | botnet_cc | 2026-09-21 | 50% |
| domain | wimanamo.workers.dev | botnet_cc | 2026-09-21 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["lanette592.workers.dev", "zulybefy.workers.dev", "lagigiri.workers.dev", "syrawilu.workers.dev", "fekydi.workers.dev", "jycolano.workers.dev", "y7muyebir6.workers.dev", "yfpdz41265.workers.dev", "6x45taub7u.workers.dev", "wimanamo.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
$shin or $_POST['cmd']) for legitimate data transmission or configuration parsing that matches the IOCs.
/var/www/html/legacy-app/) or specific file paths identified by the development team as containing these benign patterns.environment:staging or role:dev-server during business hours, or exclude specific user accounts associated with the development team (e.g., svc-dev, user-jdoe) when the action originates from an internal IP range.cron job running rsync or a custom PHP script) processes files that contain the specific IOC strings as part of their metadata or content, triggering a file-based detection.
cron or systemd-timer where the parent process is a known backup utility (e.g., borg, restic, rsync) or exclude specific file extensions (e.g., .log, .bak) if the detection is file-content based.