Web Shell - file 150.php

Hunt Hypothesis

This detection identifies adversaries deploying a malicious web shell named “150.php” to establish persistent access and execute commands on compromised web servers. Proactively hunting for this specific artifact in Azure Sentinel is critical because web shells often serve as the initial foothold for lateral movement and data exfiltration, requiring immediate investigation before attackers can expand their presence within the environment.

YARA Rule

rule webshell_PHP_150 {
	meta:
		description = "Web Shell - file 150.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "400c4b0bed5c90f048398e1d268ce4dc"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "HJ3HjqxclkZfp"
		$s1 = "<? eval(gzinflate(base64_decode('" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the Web Shell - file 150.php detection rule, including suggested filters and exclusions:

• Scheduled Backup Automation by Admin Tool

  • Scenario: The enterprise uses a centralized backup solution (e.g., Veeam Backup & Replication or Acronis Cyber Protect) that periodically generates temporary PHP scripts to verify connectivity or extract logs. These tools often create files with generic numeric naming conventions like 150.php in the web root directory during nightly maintenance windows.
  • Filter/Exclusion: Create an exclusion rule based on the source user account (e.g., svc_backup_admin) and a time window (e.g., 02:00–04:00 UTC). Additionally, exclude files where the parent process is the backup service executable (Veeam.Backup.Service.exe).

• CI/CD Pipeline Deployment Artifact

  • Scenario: During automated deployments via Jenkins or GitHub Actions, the build pipeline temporarily stages a test script named 150.php in the web server’s document root to validate database connections before finalizing the release. This file is created by the deployment service account and deleted immediately after validation, but the detection rule triggers on creation.
  • Filter/Exclusion: Exclude events where the process name matches the CI/CD agent (e.g., jenkins-agent.exe or github-runner) and the file path resides within a specific deployment staging directory (e.g., /var/www/html/staging/).

• Third-Party Analytics or Monitoring Agent Installation

  • Scenario: A security monitoring tool like Datadog, New Relic, or SolarWinds installs a lightweight PHP agent to collect server metrics. The installation script often drops a configuration