Web Shell - file smowu.php

Hunt Hypothesis

This detection identifies adversaries deploying a web shell named smowu.php to establish persistent access and execute commands on compromised web servers. Proactively hunting for this specific artifact in Azure Sentinel is critical because web shells often serve as an initial foothold for attackers to pivot laterally, exfiltrate data, or maintain long-term control within the environment before triggering broader alerts.

YARA Rule

rule webshell_C99madShell_v_3_0_smowu {
	meta:
		description = "Web Shell - file smowu.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "74e1e7c7a6798f1663efb42882b85bee"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s2 = "<tr><td width=\"50%\" height=\"1\" valign=\"top\"><center><b>:: Enter ::</b><for"
		$s8 = "<p><font color=red>Wordpress Not Found! <input type=text id=\"wp_pat\"><input ty"
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file smowu.php detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup Script Execution

  • Context: The enterprise uses a custom backup utility (e.g., Veeam Backup & Replication or a Python-based script) that periodically generates temporary PHP reports named smowu.php within the web root to log storage metrics before archiving them.
  • Filter/Exclusion: Exclude files created by the specific service account running the backup job (e.g., DOMAIN\svc_backup) and restrict the rule to trigger only if the file is modified outside of the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: CI/CD Pipeline Deployment

  • Context: During a nightly deployment cycle, the Jenkins or Azure DevOps pipeline deploys a new version of the monitoring dashboard which includes smowu.php as a standard component for status visualization. The file is created by the deployment agent (SYSTEM or IIS_IUSRS) rather than an interactive user session.
  • Filter/Exclusion: Add an exclusion based on the Process Name (e.g., jenkins-agent.exe, msbuild.exe, or w3wp.exe running under a specific AppPool identity) and exclude events where the file creation timestamp aligns with the CI/CD deployment log.

• Scenario: Scheduled Health Check Job

  • Context: A scheduled Windows Task Scheduler job runs every 15 minutes to execute a health check script that dynamically generates smowu.php in the /health-checks/ directory to visualize server uptime and load balancer status. This is a known, static artifact of the monitoring