Web Shell - file Mysql interface v1.0.php

Hunt Hypothesis

This detection identifies adversaries establishing a persistent web shell named “v1.0.php” to execute commands and maintain access via a MySQL interface on compromised web servers. Proactive hunting for this specific artifact in Azure Sentinel is critical because web shells often serve as the initial foothold for lateral movement and data exfiltration, requiring immediate investigation before attackers can deepen their presence within the environment.

YARA Rule

rule webshell_Mysql_interface_v1_0 {
	meta:
		description = "Web Shell - file Mysql interface v1.0.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "a12fc0a3d31e2f89727b9678148cd487"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "echo \"<td><a href='$PHP_SELF?action=dropDB&dbname=$dbname' onClick=\\\"return"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file Mysql interface v1.0.php detection rule, along with recommended filters and exclusions:

• Scenario: Automated Database Backup Script Execution

  • Context: The enterprise runs a nightly cron job using mysqldump that invokes a custom PHP wrapper (v1.0.php) to log backup status into the web server’s directory before archiving. This legitimate script is often located in /var/www/html/admin/backup/.
  • Filter/Exclusion: Create an exclusion rule based on File Path and Source IP. Exclude any file creation or modification events where the path matches */admin/backup/v1.0.php AND the source IP belongs to the internal backup server subnet (e.g., 192.168.10.x).

• Scenario: CMS Plugin Update via Admin Dashboard

  • Context: The IT team uses a Content Management System (CMS) like WordPress or Drupal where an administrator manually updates the “MySQL Interface” plugin. During the update process, the system temporarily stages v1.0.php in the uploads directory before finalizing the installation.
  • Filter/Exclusion: Implement a filter based on User Context and HTTP Method. Exclude events triggered by authenticated admin accounts (e.g., user groups containing “IT-Admin” or “DevOps”) where the HTTP request method is POST or PUT, indicating an active management session rather than a suspicious anonymous upload.

• Scenario: CI/CD Pipeline Deployment Artifact

  • Context: The DevOps team utilizes Jenkins or GitLab CI to deploy new application versions. As part of the deployment pipeline, the build agent pushes standard interface files, including v1.0.php, to the staging web server via an SSH/S