This hunt targets the presence of known IOCs associated with the PHP Shin webshell, a tool frequently deployed by adversaries to establish persistent, hidden backdoor access to web servers. Proactively hunting for these indicators in Azure Sentinel is critical to identify compromised web applications before attackers leverage the webshell for lateral movement, data exfiltration, or further payload execution.
Malware Family: php.shin_webshell Total IOCs: 14 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | tumyveqy.workers.dev | botnet_cc | 2026-09-19 | 50% |
| domain | 29inappropriate.workers.dev | botnet_cc | 2026-09-19 | 50% |
| domain | dc48r0dup9.workers.dev | botnet_cc | 2026-09-19 | 50% |
| domain | 8p11s24hza.workers.dev | botnet_cc | 2026-09-19 | 50% |
| domain | zunynoco.workers.dev | botnet_cc | 2026-09-19 | 50% |
| domain | kanokyhy.workers.dev | botnet_cc | 2026-09-19 | 50% |
| domain | bomurily.workers.dev | botnet_cc | 2026-09-19 | 50% |
| domain | rycupadi.workers.dev | botnet_cc | 2026-09-19 | 50% |
| domain | ngso2pi7en.workers.dev | botnet_cc | 2026-09-19 | 50% |
| domain | gracefulhermia-e2c.workers.dev | botnet_cc | 2026-09-18 | 50% |
| domain | jefecuje.workers.dev | botnet_cc | 2026-09-18 | 50% |
| domain | dredibrainy.workers.dev | botnet_cc | 2026-09-18 | 50% |
| domain | lelejefa.workers.dev | botnet_cc | 2026-09-18 | 50% |
| domain | r0zdk1ik4t.workers.dev | botnet_cc | 2026-09-18 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["tumyveqy.workers.dev", "29inappropriate.workers.dev", "dc48r0dup9.workers.dev", "8p11s24hza.workers.dev", "zunynoco.workers.dev", "kanokyhy.workers.dev", "bomurily.workers.dev", "rycupadi.workers.dev", "ngso2pi7en.workers.dev", "gracefulhermia-e2c.workers.dev", "jefecuje.workers.dev", "dredibrainy.workers.dev", "lelejefa.workers.dev", "r0zdk1ik4t.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Legacy PHP Application Maintenance: A web development team is updating an older e-commerce platform built on a custom PHP framework. During the update process, they temporarily place a known shin.php utility script in the /tmp or /var/www/html directory to debug session handling issues. Since this script matches the specific hash or string signature of the php.shin_webshell IOCs, it triggers the alert despite being a legitimate, short-lived diagnostic tool.
/tmp/, /var/tmp/, or /debug/ directories, or restrict the rule to only trigger if the file is located in standard web root directories (e.g., /var/www/html/) and has been present for more than 15 minutes.CI/CD Pipeline Artifact Caching: In a DevOps environment, a Jenkins or GitLab CI pipeline downloads PHP dependencies or test fixtures for a microservice. The pipeline caches a specific PHP helper library that shares a binary signature or string pattern with the shin_webshell IOCs (e.g., a common base64-encoded payload used for testing). The file is placed in the build agent’s workspace directory (e.g., /home/jenkins/workspace/) and is not executed by the web server, but the file-based IOC match still triggers the detection.
/home/jenkins/, /opt/gitlab-runner/, /var/lib/jenkins/) or exclude alerts where the parent process is a known build tool (e.g., java, node, python running a build script) rather than a web server process (e.g., apache2, nginx, php-fpm).Automated Backup and Restore Operations: An enterprise backup solution (e