Web Shell - file Crystal.php

Hunt Hypothesis

This detection identifies adversaries establishing a persistent web shell named “Crystal.php” to execute arbitrary commands and maintain access within web-facing applications. Proactive hunting for this artifact in Azure Sentinel is critical because web shells often serve as an initial foothold that enables attackers to pivot laterally, exfiltrate sensitive data, or escalate privileges before triggering broader alerting mechanisms.

YARA Rule

rule webshell_Crystal_Crystal {
	meta:
		description = "Web Shell - file Crystal.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "fdbf54d5bf3264eb1c4bff1fac548879"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "show opened ports</option></select><input type=\"hidden\" name=\"cmd_txt\" value"
		$s6 = "\" href=\"?act=tools\"><font color=#CC0000 size=\"3\">Tools</font></a></span></f"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file Crystal.php detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate CMS Plugin Updates via Deployment Pipelines

  • Context: During scheduled maintenance windows (e.g., Tuesday at 02:00 UTC), the DevOps team uses Jenkins or GitHub Actions to deploy updates to a WordPress or Drupal instance. The deployment script automatically creates or overwrites Crystal.php as part of a new analytics module installation.
  • Filter/Exclusion: Whitelist the specific CI/CD service account (e.g., svc-deploy-jenkins) and restrict the rule trigger to exclude file creation events where the source IP belongs to the internal build server subnet (e.g., 10.20.45.x).

• Scenario: Scheduled Backup and Integrity Verification Jobs

  • Context: The enterprise backup solution, such as Veeam or Rubrik, runs a nightly integrity check on web directories. As part of the verification process, the agent temporarily generates a test file named Crystal.php to validate read/write permissions before archiving the directory.
  • Filter/Exclusion: Create an exclusion rule for events occurring between 01:00 and 04:00 local time where the user context is the backup service account (e.g., DOMAIN\BackupService) and the file action is “Write” followed immediately by “Delete” within a 5-minute window.

• Scenario: Automated Log Rotation and Analysis Scripts

  • Context: A custom internal monitoring tool built with Python or PowerShell, running via Windows Task Scheduler, parses web server logs daily. The script generates Crystal.php as a temporary staging file to aggregate error metrics before sending