Web Shell - file smowu.php

Hunt Hypothesis

This rule detects the creation of a suspicious web shell named smowu.php, indicating an adversary has likely established a persistent foothold on a web server to execute commands and maintain access. Proactive hunting for this behavior in Azure Sentinel is critical because web shells often serve as the initial entry point for lateral movement and data exfiltration, requiring immediate investigation before attackers can expand their presence across the environment.

YARA Rule

rule webshell_c99_madnet_smowu {
	meta:
		description = "Web Shell - file smowu.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "3aaa8cad47055ba53190020311b0fb83"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "//Authentication" fullword
		$s1 = "$login = \"" fullword
		$s2 = "eval(gzinflate(base64_decode('"
		$s4 = "//Pass"
		$s5 = "$md5_pass = \""
		$s6 = "//If no pass then hash"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file smowu.php detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup or Migration Scripts

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) or data migration tools often stage temporary PHP scripts in web directories to handle large file transfers. A script named smowu.php might be a custom wrapper used by the DevOps team during nightly maintenance windows to offload logs or sync assets.
  • Filter/Exclusion: Create an exclusion based on the Source User Account (e.g., svc-backup-agent) and restrict detection to specific time windows (e.g., 02:00–04:00 UTC). Alternatively, exclude files where the Last Modified timestamp matches the scheduled job execution time exactly.

• Scenario: Third-Party Analytics or Monitoring Agents

  • Context: Security monitoring tools like Datadog, New Relic, or SolarWinds often deploy lightweight PHP agents to collect server metrics. These agents may dynamically generate a file named smowu.php (potentially standing for “System Monitor Overhead Web Utility”) within the document root (/var/www/html) to serve real-time dashboards.
  • Filter/Exclusion: Exclude files located in specific subdirectories known for third-party tools, such as /var/www/html/analytics/ or /opt/monitoring/web/. Additionally, filter by the Process Name creating the file (e.g., newrelic-php-agent.exe or datadog-checks).

• Scenario: CI/CD Pipeline Deployment Artifacts

  • Context: During a Continuous Integration/Continuous Deployment (CI/CD) run using tools like Jenkins, GitLab CI, or Azure DevOps