Web Shell - file metaslsoft.php

Hunt Hypothesis

This detection identifies adversaries deploying a malicious web shell named metaslsoft.php to establish persistent access and execute commands on compromised web servers. Proactive hunting for this specific artifact in Azure Sentinel is critical because web shells often serve as an initial foothold that enables attackers to escalate privileges, exfiltrate data, or move laterally across the environment before triggering broader alerts.

YARA Rule

rule webshell_metaslsoft {
	meta:
		description = "Web Shell - file metaslsoft.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "aa328ed1476f4a10c0bcc2dde4461789"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s7 = "$buff .= \"<tr><td><a href=\\\"?d=\".$pwd.\"\\\">[ $folder ]</a></td><td>LINK</t"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file metaslsoft.php detection rule, including suggested filters or exclusions:

• Scenario: Legitimate Deployment via CI/CD Pipeline

  • Context: The DevOps team uses GitHub Actions or Jenkins to deploy updates to the web server. During a scheduled nightly deployment window, the pipeline pushes metaslsoft.php as part of a standard module update for the internal reporting dashboard.
  • Suggested Filter/Exclusion: Create an exclusion rule that ignores alerts where the source IP belongs to the CI/CD subnet (e.g., 10.20.50.x) and the process name is svc-jenkins or github-runner. Additionally, filter based on a time window (e.g., 02:00–04:00 UTC) when deployments are known to occur.

• Scenario: Scheduled Backup and Maintenance Job

  • Context: A nightly maintenance script executed by the System Center Configuration Manager (SCCM) or a custom PowerShell job runs on the web server. This job temporarily creates or updates metaslsoft.php to log backup status metrics before archiving the file.
  • Suggested Filter/Exclusion: Exclude events where the parent process is powershell.exe, cscagent.exe, or taskeng.exe. Furthermore, filter by file modification time if the change occurs exactly at a scheduled minute (e.g., 03:15 AM daily) and the user context is a dedicated service account like svc-webmaint.

• Scenario: Admin Manual Configuration via Remote Desktop

  • Context: A senior web administrator logs in via Remote Desktop Services (RDP) to manually tweak configuration parameters within metaslsoft.php during a change request window