Web Shell - file cpg_143_incl_xpl.php

Hunt Hypothesis

This detection identifies adversaries deploying a malicious web shell named cpg_143_incl_xpl.php to establish persistent access and execute commands on compromised web servers. Proactive hunting for this specific artifact in Azure Sentinel is critical because web shells often serve as the initial foothold for attackers, enabling them to escalate privileges, exfiltrate data, or move laterally before triggering broader alerting mechanisms.

YARA Rule

rule webshell_cpg_143_incl_xpl {
	meta:
		description = "Web Shell - file cpg_143_incl_xpl.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "5937b131b67d8e0afdbd589251a5e176"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s3 = "$data=\"username=\".urlencode($USER).\"&password=\".urlencode($PA"
		$s5 = "fputs($sun_tzu,\"<?php echo \\\"Hi Master!\\\";ini_set(\\\"max_execution_time"
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Legitimate deployment of the “Copperleaf” inventory management module by the DevOps team using Jenkins CI/CD pipelines. The pipeline automatically pushes cpg_143_incl_xpl.php to the /var/www/html/modules/inventory/ directory during nightly builds, which triggers the web shell detection due to the file’s extension and naming convention resembling known malicious artifacts.

  • Filter/Exclusion: Create a rule exclusion for files created by the jenkins-build service account within the specific path /var/www/html/modules/inventory/, or add a filter excluding file hashes that match the known good signature of this module version (e.g., SHA256: a1b2c3...).

• Scenario: Scheduled maintenance job executed by the internal “SiteReliability” team using Ansible Tower to update the customer portal’s XML parser. The playbook explicitly copies a utility script named cpg_143_incl_xpl.php from a secure artifact repository (Nexus) to the web root every Sunday at 02:00 AM, causing a spike in file creation events that mimics web shell behavior.

  • Filter/Exclusion: Implement a time-based exclusion window for this specific filename between 01:30 and 02:30 on Sundays, or filter out events where the Source_IP belongs to the Ansible Tower management subnet (e.g., 10.50.10.0/24).

• Scenario: The IT Security team manually deploys a custom diagnostic tool named cpg_143_incl_xpl.php via SSH for a temporary vulnerability assessment on the public-facing web server cluster. This file is used to generate real-time XML logs of incoming traffic patterns and is uploaded by the admin-soc user, triggering the detection due to its