Web Shell - file NetworkFileManagerPHP.php

Hunt Hypothesis

This detection identifies adversaries deploying a PHP web shell named NetworkFileManagerPHP.php to establish persistent access and execute arbitrary commands on compromised web servers. Proactive hunting for this artifact in Azure Sentinel is critical because web shells often serve as the initial foothold for lateral movement and data exfiltration, requiring immediate investigation before attackers can expand their presence within the environment.

YARA Rule

rule webshell_NetworkFileManagerPHP {
	meta:
		description = "Web Shell - file NetworkFileManagerPHP.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "acdbba993a5a4186fd864c5e4ea0ba4f"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s9 = "  echo \"<br><center>All the data in these tables:<br> \".$tblsv.\" were putted "
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file NetworkFileManagerPHP.php detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup Script Execution by Admin

  • Context: The internal backup solution (e.g., Veeam or Acronis) runs a scheduled job that utilizes NetworkFileManagerPHP.php to archive network logs to an external S3 bucket. This script is hosted in the standard C:\inetpub\wwwroot\admin\tools directory and executes every night at 02:00 AM via a Windows Task Scheduler trigger.
  • Filter/Exclusion: Exclude file paths containing \admin\tools\ from the detection scope, or add an exclusion rule for process names matching Veeam.Backup.Service.exe or AcronisCyberProtect.exe when accessing this specific filename during the 01:30–02:30 time window.

• Scenario: Deployment of a New Network Monitoring Dashboard

  • Context: The DevOps team deploys a new network monitoring module using Ansible or Jenkins CI/CD pipelines. As part of the deployment, the pipeline creates NetworkFileManagerPHP.php in the /var/www/html/network-monitor directory to handle real-time traffic visualization widgets. This is a legitimate, version-controlled artifact pushed from the Git repository.
  • Filter/Exclusion: Create an exclusion for files created by process names jenkins-agent.exe or ansible-runner, specifically when the file hash matches the known good SHA-256 hash stored in the configuration management database (CMDB) for this deployment artifact.

• Scenario: Third-Party Integration with Network Management System

  • Context: The enterprise uses a third-party network management tool (e.g., SolarWinds or PRTG) that integrates with the web