Web Shell - file PH Vayv.php

Hunt Hypothesis

This detection identifies adversaries establishing a persistent web shell named “Vayv.php” on Azure-hosted web servers to enable remote command execution and lateral movement. Proactively hunting for this specific artifact in Azure Sentinel is critical because web shells often serve as an initial foothold, allowing attackers to maintain stealthy access while exfiltrating sensitive data or deploying additional malware.

YARA Rule

rule webshell_PH_Vayv_PH_Vayv {
	meta:
		description = "Web Shell - file PH Vayv.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "35fb37f3c806718545d97c6559abd262"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "style=\"BACKGROUND-COLOR: #eae9e9; BORDER-BOTTOM: #000000 1px in"
		$s4 = "<font color=\"#858585\">SHOPEN</font></a></font><font face=\"Verdana\" style"
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Web Shell - file PH Vayv.php” detection rule, including targeted filters and exclusions:

• Scheduled Backup or Migration Scripts

  • Scenario: Enterprise backup solutions (e.g., Veeam, Rubrik) or migration tools often stage temporary PHP scripts during nightly windows to manage file transfers. A script named Vayv.php might be deployed by the DevOps team as part of a specific “Validation and Verification” (Vayv) module for database synchronization, which mimics web shell behavior by reading/writing files in the web root.
  • Filter/Exclusion: Exclude file creation events where the parent process is veeam.exe or rubrik-agent.exe, OR add a whitelist entry for the specific directory path /backup_staging/Vayv.php.

• CI/CD Pipeline Deployment Artifacts

  • Scenario: During automated deployments via tools like Jenkins, GitLab CI, or Azure DevOps, temporary build artifacts are often pushed to the web server’s public_html directory. A deployment step might instantiate a Vayv.php script to verify container health or validate API endpoints before the main application goes live, triggering the rule due to its PHP extension and active file I/O operations.
  • Filter/Exclusion: Create an exclusion based on the user context; if the file creation is performed by the service account svc-deploy-agent or jenkins-build, suppress the alert for this specific filename.

• Third-Party Analytics or Monitoring Agents

  • Scenario: Cloud monitoring tools such as Datadog, New Relic, or Splunk Universal Forwarder often install lightweight PHP agents to collect server metrics. These agents may dynamically generate a Vayv.php file (standing for