Web Shell - file Dx.php

Hunt Hypothesis

This detection identifies adversaries deploying “Dx.php” web shells to establish persistent command-and-control channels and execute arbitrary commands on compromised web servers. Proactive hunting for this specific artifact is critical in Azure Sentinel to rapidly identify early-stage post-exploitation activities that often evade standard signature-based defenses before lateral movement occurs.

YARA Rule

rule webshell_Dx_Dx {
	meta:
		description = "Web Shell - file Dx.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
		$s9 = "class=linelisting><nobr>POST (php eval)</td><"
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file Dx.php detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Backup and Migration Tools

  • Context: Enterprise backup solutions like Veeam, Rubrik, or Acronis Cyber Protect often deploy temporary PHP scripts (sometimes named Dx.php for “Diagnostic”) to verify storage connectivity, validate database integrity, or perform pre-migration health checks on web server nodes.
  • Filter/Exclusion: Exclude files created by the specific service accounts used by these tools (e.g., svc-veeam, rubic-agent) and restrict the rule to only trigger if the file is created outside of defined maintenance windows or in non-standard directories like /var/www/html instead of /opt/backups.

• Scenario: CI/CD Pipeline Deployment Artifacts

  • Context: During automated deployments via Jenkins, GitLab CI, or Azure DevOps, the build pipeline may temporarily stage a diagnostic script named Dx.php within the artifact staging area before the final application container is spun up. This often happens during “smoke tests” where the pipeline verifies the web server’s ability to render PHP content.
  • Filter/Exclusion: Implement an exclusion based on the source IP address of the CI/CD runner (e.g., 10.20.30.x) and exclude any file creation events occurring within the specific artifact staging directory path (e.g., /tmp/artifacts/deploy-stage).

• Scenario: Third-Party Monitoring and APM Agents

  • Context: Application Performance Monitoring tools such as Dynatrace, New Relic One, or Datadog often install lightweight PHP agents that include a diagnostic endpoint (`Dx.php