ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hypothesis targets adversaries deploying the php.shin_webshell to establish persistent command-and-control channels on compromised web servers, enabling remote code execution and data exfiltration. Proactively hunting for these indicators in Azure Sentinel is critical to detect early-stage intrusions that often bypass traditional perimeter defenses by masquerading as legitimate traffic or files.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 8 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["xalexo.workers.dev", "d83fvnq4f0.workers.dev", "bgh7fgpgvk.workers.dev", "kikk69fvi2.workers.dev", "ltcor72282.workers.dev", "wavedato.workers.dev", "degebi.workers.dev", "lulugisy.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — php.shin_webshell

False Positive Guidance

• Scenario: A DevOps engineer deploys a custom PHP-based health check script or a lightweight API endpoint (e.g., /status.php or /ping.php) on a web server to monitor service availability. The script may use standard PHP functions like file_get_contents() or curl to fetch external metrics, potentially matching IOC patterns for outbound C2 communication or unusual file access.

  • Filter/Exclusion: Exclude known application-specific paths (e.g., /health, /api/v1/status) and allowlist the specific user account or service principal (e.g., svc-deploy, app-pool-identity) associated with the deployment pipeline.

• Scenario: A system administrator runs a scheduled PowerShell or Bash job that invokes php-cgi or a PHP CLI interpreter to process log files or generate reports from a web application’s data directory. This legitimate administrative task may trigger alerts if the PHP process initiates network connections to internal reporting servers or accesses sensitive configuration files.

  • Filter/Exclusion: Correlate the PHP process creation with a parent process of powershell.exe, bash, or cron and exclude instances where the working directory is within standard log or report directories (e.g., /var/log/app, /opt/reports).

• Scenario: A web application uses a legitimate PHP library (such as Guzzle or cURL) to make outbound HTTPS requests to third-party APIs (e.g., payment gateways, SaaS providers) for transaction processing or data synchronization. The encrypted traffic and specific User-Agent strings might mimic the C2 behavior of the shin_webshell if the IOC list includes generic PHP network activity.

  • Filter/Exclusion: Allowlist known external IP ranges or domain names associated with approved SaaS providers (e.g., *.stripe.com, *.aws.com) and exclude PHP processes where the parent process is the web