Web Shell - file Antichat Shell v1.3.php

Hunt Hypothesis

This detection identifies the deployment of a malicious “Antichat Shell v1.3.php” web shell, indicating an adversary has established a persistent backdoor on a web server to facilitate remote command execution and data exfiltration. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before attackers can leverage this foothold for deeper network reconnaissance or credential theft.

YARA Rule

rule webshell_Antichat_Shell_v1_3_2 {
	meta:
		description = "Web Shell - file Antichat Shell v1.3.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "40d0abceba125868be7f3f990f031521"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s3 = "$header='<html><head><title>'.getenv(\"HTTP_HOST\").' - Antichat Shell</title><m"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file Antichat Shell v1.3.php detection rule, along with suggested filters and exclusions:

Scenario: Legitimate Deployment via CI/CD Pipeline
- Context: The DevOps team uses GitHub Actions or Jenkins to deploy the latest version of the internal chat application (Antichat) during nightly builds. The pipeline explicitly uploads v1.3.php to the web root directory as part of a standard release process, mimicking a manual file upload often associated with web shell creation.
- Suggested Filter/Exclusion: Create an exclusion rule based on the source IP address and user agent. Exclude alerts where the source IP belongs to the CI/CD subnet (e.g., 10.20.30.0/24) or where the HTTP User-Agent string contains specific identifiers like GitHub-Hookshot or Jenkins.
Scenario: Scheduled Backup and Restoration Job
- Context: The enterprise runs a nightly automated backup job using Veeam Backup & Replication. During the restoration phase of the chat module, the system re-deploys the Antichat Shell v1.3.php file to ensure consistency with the backup image. This scheduled task triggers the rule because it involves writing a PHP file to the web server’s document root at a fixed time (e.g., 02:00 AM).
- Suggested Filter/Exclusion: Implement a time-based exclusion or a process-name filter. Exclude alerts occurring between 01:30 and 03:30 on weekdays, or specifically exclude events where the initiating process name is vbrservice.exe (Veeam) or cron running under the backup_admin account.