Web Shell - file Ani-Shell.php

Hunt Hypothesis

This detection identifies the creation of a suspicious web shell named “Ani-Shell.php,” which adversaries often deploy to establish persistent remote access and execute commands on compromised web servers. Proactively hunting for this artifact in Azure Sentinel is critical because web shells serve as a primary foothold for attackers to escalate privileges, exfiltrate data, or pivot deeper into the network before triggering broader alerts.

YARA Rule

rule webshell_Ani_Shell {
	meta:
		description = "Web Shell - file Ani-Shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "889bfc9fbb8ee7832044fc575324d01a"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "$Python_CODE = \"I"
		$s6 = "$passwordPrompt = \"\\n================================================="
		$s7 = "fputs ($sockfd ,\"\\n==============================================="
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file Ani-Shell.php detection rule, along with recommended filters and exclusions:

• Scenario: Automated Backup Script Execution

  • Context: The enterprise uses a custom backup utility named BackupManager that periodically deploys a temporary diagnostic script (Ani-Shell.php) to the web root /var/www/html/diagnostics/ to verify disk I/O and network latency before archiving logs. This file is created, executed once, and immediately deleted by the script itself.
  • Filter/Exclusion: Exclude files located in the specific path */diagnostics/* where the parent directory was created less than 24 hours ago, or add a filter to ignore events where the user context is the service account svc-backup-agent.

• Scenario: CI/CD Pipeline Deployment

  • Context: During nightly deployment cycles, the Jenkins pipeline (running as user jenkins-build) utilizes Ansible playbooks to push a standard health-check module named Ani-Shell.php into the /opt/webapp/staging/public/ directory. This is part of the automated “smoke test” phase before promoting code to production.
  • Filter/Exclusion: Create an exclusion rule for file creation events where the source IP belongs to the CI/CD subnet (e.g., 10.20.5.0/24) and the process name matches jenkins-agent or ansible-runner.

• Scenario: Scheduled Security Scanner Maintenance

  • Context: The internal security team runs a weekly vulnerability assessment using Tenable Nessus. As part of its agentless scanning module, it temporarily injects Ani-Shell.php into the web server’s document root to test for specific PHP configuration vulnerabilities and then removes it upon completion.