Web Shell - file h4ntu shell powered by tsoi.php

Hunt Hypothesis

This rule detects adversaries deploying a specific web shell variant (h4ntu/tsoi.php) to establish persistent access and execute commands on compromised web servers. Proactively hunting for this behavior in Azure Sentinel is critical because web shells often serve as an initial foothold that enables attackers to escalate privileges, exfiltrate data, or move laterally across the environment before triggering broader alerts.

YARA Rule

rule WEBSHELL_H4ntu_Shell_Powered_Tsoi_3 {
   meta:
      description = "Web Shell - file h4ntu shell powered by tsoi.php"
      author = "Florian Roth"
      date = "2014-01-28"
      modified = "2025-03-21"
      score = 70
      old_rule_name = "Webshell_h4ntu_shell_powered_by_tsoi_"
      hash = "06ed0b2398f8096f1bebf092d0526137"
      id = "d9cd4005-5661-52db-be69-8a633a4b00ba"
   strings:
      $s0 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>Server Adress:</b"
      $s3 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>User Info:</b> ui"
      $s4 = "    <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><?= $info ?>: <?= "
   condition:
      2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file h4ntu shell powered by tsoi.php detection rule, including suggested filters and exclusions:

• Scenario 1: Automated Backup and Migration Scripts

  • Context: Enterprise backup solutions like Veeam or Rubrik often deploy temporary PHP scripts to manage file transfers between on-premises servers and cloud storage. These scripts may include a header string identifying the tool as “h4ntu shell” during the initialization phase of a nightly migration job.
  • Filter/Exclusion: Create an exclusion for files created by specific service accounts (e.g., svc_backup_veeam) or restrict the detection to exclude file paths within dedicated backup directories such as /opt/backups/tmp or C:\ProgramData\Veeam\Temp.

• Scenario 2: Third-Party CMS Plugin Updates

  • Context: Content Management Systems like WordPress or Drupal, when running popular plugins (e.g., Advanced Custom Fields or Yoast SEO), may utilize a helper script named tsoi.php for configuration management. During an automated update cycle, the plugin installer might generate a temporary shell file with the specific “h4ntu” signature to verify database connectivity before applying changes.
  • Filter/Exclusion: Exclude files located within standard CMS plugin directories (e.g., /var/www/html/wp-content/plugins/* or C:\inetpub\wwwroot\plugins) and limit alerts to only trigger if the file is created outside of defined maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario 3: DevOps Pipeline Artifact Deployment

  • Context: CI/CD platforms like Jenkins, GitLab CI, or **Azure DevOps