This hunt targets the presence of known IOCs associated with the php.shin_webshell, indicating that an adversary has likely established a persistent foothold on a web server to execute arbitrary commands. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised endpoints before the webshell is leveraged for lateral movement or data exfiltration, thereby reducing the mean time to detection for high-severity web application attacks.
Malware Family: php.shin_webshell Total IOCs: 7 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | lemyjyhu.workers.dev | botnet_cc | 2026-09-22 | 50% |
| domain | cameji.workers.dev | botnet_cc | 2026-09-22 | 50% |
| domain | pdagr01372.workers.dev | botnet_cc | 2026-09-22 | 50% |
| domain | kifafijy.workers.dev | botnet_cc | 2026-09-22 | 50% |
| domain | uckvj18869.workers.dev | botnet_cc | 2026-09-22 | 50% |
| domain | kkrot49695.workers.dev | botnet_cc | 2026-09-22 | 50% |
| domain | mspur68524.workers.dev | botnet_cc | 2026-09-22 | 50% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - php.shin_webshell
let malicious_domains = dynamic(["lemyjyhu.workers.dev", "cameji.workers.dev", "pdagr01372.workers.dev", "kifafijy.workers.dev", "uckvj18869.workers.dev", "kkrot49695.workers.dev", "mspur68524.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
shin_webshell script for debugging purposes.
/wp-content/plugins/legacy-debug/) or allow the specific SHA256 hash of the known benign plugin version.shin_webshell as a quick temporary file manager to upload assets before deploying to production, where it is expected to exist.
/var/www/staging/, /opt/dev-env/) or where the host is tagged with env=staging.cron job restores a full filesystem backup from a previous incident, which inadvertently includes the webshell file that was present at the time of the backup.
rsync or restic jobs) and exclude if the parent process is a known backup utility./var/lib/docker/overlay2/...) or if the host is identified as a container node and the file hash matches the known base image manifest.