Web Shell - file Macker's Private PHPShell.php

Hunt Hypothesis

This detection identifies adversaries deploying a private PHP web shell to establish persistent command-and-control access and execute arbitrary commands on compromised web servers. Proactive hunting for this artifact in Azure Sentinel is critical because web shells often evade standard signature-based defenses by mimicking legitimate application files, allowing attackers to maintain stealthy footholds within the environment.

YARA Rule

rule webshell_Macker_s_Private_PHPShell {
	meta:
		description = "Web Shell - file Macker's Private PHPShell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "e24cbf0e294da9ac2117dc660d890bb9"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s3 = "echo \"<tr><td class=\\\"silver border\\\">&nbsp;<strong>Server's PHP Version:&n"
		$s4 = "&nbsp;&nbsp;<?php echo buildUrl(\"<font color=\\\"navy\\\">["
		$s7 = "echo \"<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\"><input type="
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file Macker’s Private PHPShell.php detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup Script Execution

  • Context: The enterprise uses a nightly backup job (e.g., running via cron or Windows Task Scheduler) that utilizes the PHPShell.php utility to archive logs from the web root. During execution, the script creates temporary instances of this file in the /var/www/html/backups/ directory, triggering the rule as it mimics a new shell deployment.
  • Filter/Exclusion: Exclude files created within specific backup directories (e.g., path contains '/backups/') where the parent process is the known backup service account (e.g., backup_svc or SYSTEM).

• Scenario: CI/CD Pipeline Deployment

  • Context: During a routine deployment via Jenkins or GitLab CI, the pipeline pushes updated web artifacts to the production server. The deployment script explicitly copies PHPShell.php as part of the standard application bundle into the /var/www/html/app/core/ directory. This is a legitimate update, not an attacker’s injection.
  • Filter/Exclusion: Filter out events where the source user is the CI/CD service account (e.g., jenkins-agent, gitlab-runner) and the file path matches the standard application core directory structure.

• Scenario: Developer Maintenance Window

  • Context: During a scheduled maintenance window, a senior developer logs into the server via SSH to troubleshoot an issue. They manually copy PHPShell.php from their local workstation to the /var/www/html/tools/ directory using scp or rsync to run immediate diagnostics and command-line tests on the live environment.
  • Filter/Exclusion: Exclude