This hypothesis targets the deployment of the php.shin_webshell, which adversaries use to establish persistent remote code execution on web servers for data exfiltration and lateral movement. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised web assets early, preventing the malware from leveraging weak credentials or unpatched vulnerabilities to deepen its foothold within the environment.
Malware Family: php.shin_webshell Total IOCs: 4 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | saloxa.workers.dev | botnet_cc | 2026-09-27 | 50% |
| domain | nbthjm6925.workers.dev | botnet_cc | 2026-09-27 | 50% |
| domain | ovxiz00671.workers.dev | botnet_cc | 2026-09-27 | 50% |
| domain | bmdul37446.workers.dev | botnet_cc | 2026-09-27 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["saloxa.workers.dev", "nbthjm6925.workers.dev", "ovxiz00671.workers.dev", "bmdul37446.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a standard PHP-based deployment script (e.g., deploy.php) to push configuration updates to a staging web server via a CI/CD pipeline (like Jenkins or GitHub Actions). The script executes system() or exec() functions to run shell commands for restarting services or clearing caches, which matches the “remote code execution” behavior of the webshell.
10.20.0.0/24) AND the user agent or process name contains jenkins-agent or github-runner. Additionally, whitelist known deployment script paths (e.g., /var/www/html/scripts/deploy.php).Scenario: An IT administrator performs a manual backup of a legacy PHP application using a custom script that invokes shell_exec() to compress files and transfer them to an internal NAS. This legitimate administrative task triggers the detection because it involves server-side command execution from a PHP context.
svc_backup) that execute PHP scripts from the /opt/backups/ directory. Filter out events where the destination IP is the internal NAS address (e.g., 192.168.10.50) and the command line contains tar or rsync.Scenario: A security team runs a periodic vulnerability scan using a tool like Nessus or Qualys that includes a PHP-based probe to test for known RCE vulnerabilities in the web stack. The probe intentionally executes harmless PHP code to verify response behavior, mimicking webshell activity.