Web Shell - file ironshell.php

Hunt Hypothesis

This detection identifies adversaries deploying the “ironshell.php” web shell to establish a persistent foothold on web servers for command execution and lateral movement. Proactive hunting in Azure Sentinel is critical because web shells often evade standard network monitoring, requiring file system analysis to uncover stealthy post-exploitation activities that could lead to data exfiltration or full system compromise.

YARA Rule

rule webshell_ironshell {
	meta:
		description = "Web Shell - file ironshell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s4 = "print \"<form action=\\\"\".$me.\"?p=cmd&dir=\".realpath('.').\""
		$s8 = "print \"<td id=f><a href=\\\"?p=rename&file=\".realpath($file).\"&di"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file ironshell.php detection rule, including suggested filters or exclusions:

• Scenario: Managed Backup and Migration Tool Deployment

  • Context: The enterprise uses SolarWinds Backup or Veeam Agent, which periodically deploys a temporary PHP management script named ironshell.php to the web root (/var/www/html) during nightly migration jobs. This file acts as a bridge for the backup agent to verify connectivity and retrieve logs before being automatically deleted post-job.
  • Filter/Exclusion: Create an exclusion based on the Source Host (e.g., backup-server-01, veeam-repo) and the File Creation Timestamp. Exclude alerts where the file is created between 02:00 and 04:00 UTC by these specific hosts, provided the file size remains under 5KB.

• Scenario: DevOps CI/CD Pipeline Artifact

  • Context: The Jenkins or GitLab Runner automation pipeline deploys a custom health-check utility named ironshell.php to the staging environment’s web server (nginx-staging) as part of the “Post-Deployment Verification” stage. This script is executed by the CI/CD agent to validate API endpoints before marking the build as successful.
  • Filter/Exclusion: Filter alerts where the Source User matches the service account svc-jenkins-deploy and the Target Directory path contains /staging/. Additionally, exclude events where the file modification occurs within 15 minutes of a pipeline trigger event ID (e.g., JENKINS-BUILD-START).

• Scenario: Third-Party Monitoring Agent Installation

  • Context: The Datadog or New Relic infrastructure