This hypothesis targets the presence of the php.shin_webshell, a remote code execution tool that adversaries deploy to establish persistent access and exfiltrate data from compromised web servers. Proactively hunting for these IOCs in Azure Sentinel is critical to identify stealthy backdoors that may have been introduced via phishing or exploit kits before they are leveraged for lateral movement or data theft.
Malware Family: php.shin_webshell Total IOCs: 8 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | e5ufcx9x6e.workers.dev | botnet_cc | 2026-09-25 | 50% |
| domain | pxinb13757.workers.dev | botnet_cc | 2026-09-25 | 50% |
| domain | zejaziri.workers.dev | botnet_cc | 2026-09-25 | 50% |
| domain | 5yuj1m1rfv.workers.dev | botnet_cc | 2026-09-25 | 50% |
| domain | xegyfelo.workers.dev | botnet_cc | 2026-09-25 | 50% |
| domain | fanulisi.workers.dev | botnet_cc | 2026-09-25 | 50% |
| domain | lizususo.workers.dev | botnet_cc | 2026-09-25 | 50% |
| domain | violetdonia.workers.dev | botnet_cc | 2026-09-25 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["e5ufcx9x6e.workers.dev", "pxinb13757.workers.dev", "zejaziri.workers.dev", "5yuj1m1rfv.workers.dev", "xegyfelo.workers.dev", "fanulisi.workers.dev", "lizususo.workers.dev", "violetdonia.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Legitimate PHP Debugging or Profiling Tools: Developers or DevOps engineers may install lightweight PHP profiling extensions (e.g., Xdebug, Blackfire, or New Relic Agent) that hook into the PHP runtime to capture execution traces. If these tools create temporary files or modify auto_prepend_file/auto_append_file directives in php.ini or .htaccess to inject profiling code, the resulting file structure or hash might match generic webshell IOCs.
/var/www/html/.debug/, /opt/blackfire/) or exclude processes spawned by known profiling daemons (e.g., blackfire-agent, xdebug).CI/CD Pipeline Build Artifacts: In containerized or ephemeral build environments (e.g., Jenkins, GitLab CI, or GitHub Actions), PHP applications are often compiled or copied into temporary workspaces. The build process may generate intermediate PHP files, cache directories, or bootstrap scripts that resemble webshell structures (e.g., index.php with obfuscated code for testing). These files are transient and exist only during the build job.
/workspace/, /home/jenkins/agent/workspace/, /tmp/ci-builds/) and correlate with active pipeline job IDs or timestamps to confirm the file was created by a known build process.Third-Party Plugin or Module Installation: Enterprise web servers often host large CMS platforms (e.g., WordPress, Drupal, Joomla) or e-commerce suites (e.g., Magento, Shopify Plus) that rely on numerous third-party plugins. Some plugins (e.g., caching modules like W3 Total Cache, or security plugins like Wordfence) may create temporary PHP files for script execution, cache management