ThreatFox: php.shin_webshell IOCs

Hunt Hypothesis

This hunt targets the presence of known PHP Shin webshell indicators, which adversaries deploy to establish persistent, hidden command execution capabilities within web servers. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised web assets before attackers leverage the backdoor for lateral movement or data exfiltration.

IOC Summary

Malware Family: php.shin_webshell Total IOCs: 3 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	`nomoca.workers.dev`	botnet_cc	2026-09-23	50%
domain	`logycedo.workers.dev`	botnet_cc	2026-09-23	50%
domain	`l2a54f5j47.workers.dev`	botnet_cc	2026-09-23	50%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["nomoca.workers.dev", "logycedo.workers.dev", "l2a54f5j47.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — php.shin_webshell

False Positive Guidance

Scenario: A legacy PHP application (e.g., an older version of WordPress or a custom internal tool) uses the shin library or a similar lightweight shell wrapper for administrative maintenance tasks, such as clearing cache or rotating logs, which matches the specific file path or hash IOC.
- Filter/Exclusion: Exclude alerts where the source file path contains /vendor/ or /lib/ and the parent process is a known web server (e.g., apache2, nginx, php-fpm) rather than an interactive user session.
Scenario: A DevOps engineer performs a manual security audit or penetration test on a staging environment, intentionally deploying the php.shin_webshell script to verify detection capabilities or test backup restoration procedures.
- Filter/Exclusion: Exclude alerts originating from hosts tagged with environment=staging or environment=dev, or where the user account belongs to the PenTest or DevOps security group.
Scenario: A scheduled cron job or Windows Task Scheduler entry runs a PHP-based backup script that includes a temporary copy of the webshell file for integrity checking or as part of a complex deployment pipeline (e.g., using composer or ansible to sync files).
- Filter/Exclusion: Exclude alerts where the parent process is cron, crond, schtasks, or ansible-playbook, and the file creation timestamp aligns with the known schedule of the deployment job.
Scenario: A third-party plugin or module for a CMS (like Joomla or Drupal) bundles a utility script named similarly to the IOC (e.g., shin.php or shin_webshell.php) for performance monitoring or debugging, which is loaded during routine site updates.
- Filter/Exclusion: Exclude alerts where the file resides within a known