Web Shell - file B374k.php

Hunt Hypothesis

This detection identifies potential web shell deployments where adversaries establish a persistent backdoor via a newly created PHP file named “B374k.php” to execute arbitrary commands on compromised servers. Proactively hunting for this specific artifact in Azure Sentinel is critical because attackers often use obfuscated filenames like B374k.php to evade standard signature-based detection and maintain long-term access to sensitive web infrastructure.

YARA Rule

rule webshell_B374kPHP_B374k {
	meta:
		description = "Web Shell - file B374k.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "bed7388976f8f1d90422e8795dff1ea6"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "Http://code.google.com/p/b374k-shell" fullword
		$s1 = "$_=str_rot13('tm'.'vas'.'yngr');$_=str_rot13(strrev('rqb'.'prq'.'_'.'46r'.'fno'"
		$s3 = "Jayalah Indonesiaku & Lyke @ 2013" fullword
		$s4 = "B374k Vip In Beautify Just For Self" fullword
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file B374k.php detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup Script Execution by Admin Tools

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often deploy temporary PHP scripts to the web root during nightly maintenance windows. These tools frequently generate generic filenames (e.g., B374k.php) as part of their internal staging process before archiving data.
  • Filter/Exclusion: Create an exclusion rule that ignores alerts where the source IP belongs to the Backup Server Subnet and the file creation timestamp falls within the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: CI/CD Pipeline Deployment of Staging Artifacts

  • Context: During a deployment cycle using Jenkins or GitLab CI, the pipeline may upload temporary build artifacts to the staging web server. The artifact naming convention often includes random alphanumeric strings like B374k.php for version control tracking before the final release is promoted to production.
  • Filter/Exclusion: Exclude alerts triggered by processes running under the specific service account used by the CI/CD agent (e.g., svc-jenkins-deploy) and restrict the scope to the Staging Environment directory, excluding Production paths.

• Scenario: Scheduled Log Rotation and Analysis Job

  • Context: A scheduled task managed by Windows Task Scheduler or a cron job running an internal audit tool (e.g., Splunk Universal Forwarder) may generate a temporary PHP wrapper script named B374k.php to parse access logs before sending them to the SIEM.
  • **Filter/Exclusion