Web Shell - file guo.php

Hunt Hypothesis

This hunt hypothesis detects adversaries establishing a persistent backdoor by deploying a PHP-based web shell named guo.php to enable unauthorized remote code execution on web servers. A SOC team should proactively hunt for this activity in Azure Sentinel because such shells often serve as the initial foothold for attackers to maintain access, exfiltrate sensitive data, and pivot within the network environment before triggering standard alert thresholds.

YARA Rule

rule webshell_caidao_shell_guo {
	meta:
		description = "Web Shell - file guo.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "9e69a8f499c660ee0b4796af14dc08f0"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "<?php ($www= $_POST['ice'])!"
		$s1 = "@preg_replace('/ad/e','@'.str_rot13('riny').'($ww"
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for Rule: Web Shell - file guo.php

• Scenario 1: Automated Deployment via CI/CD Pipeline

  • Context: The DevOps team utilizes Jenkins or GitHub Actions to deploy a new version of the customer portal. As part of the standard deployment script, a generic utility file named guo.php (used for health checks and logging) is pushed to the /var/www/html/health/ directory on the web server.
  • Suggested Filter: Exclude files located within specific application subdirectories known for dynamic deployments.
    • Filter Logic: Path contains "/var/www/html/health/" OR Path contains "/deployments/" AND Filename = "guo.php".

• Scenario 2: Scheduled Maintenance and Backup Utility

  • Context: The internal IT operations team runs a nightly maintenance job using Cron that executes a custom PHP script named guo.php to generate daily backup reports and verify database connectivity. This script is triggered automatically at 02:00 AM by the system scheduler, not by user interaction.
  • Suggested Filter: Exclude events occurring during defined maintenance windows or originating from specific service accounts.
    • Filter Logic: (Time between "01:30" and "04:00") AND (Source User = "svc-backup" OR Source Process = "cron").

• Scenario 3: Third-Party Integration Module Installation

  • Context: The enterprise integrates a new analytics dashboard provided by an external vendor. During the installation phase, the vendor’s installer creates guo.php in the /opt/analytics/api/ directory to handle API authentication and data ingestion. This is a standard component of their software suite.
  • Suggested Filter: Whitelist files