Web Shell - file 404.php

Hunt Hypothesis

This detection identifies adversaries establishing a web shell disguised as an HTTP error page (404.php) to maintain persistence and execute commands on compromised web servers. Proactive hunting for this anomaly in Azure Sentinel is critical because attackers often leverage such innocuous filenames to evade standard monitoring, allowing them to establish covert command-and-control channels before broader compromise occurs.

YARA Rule

rule webshell_PHP_404 {
	meta:
		description = "Web Shell - file 404.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "078c55ac475ab9e028f94f879f548bca"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s4 = "<span>Posix_getpwuid (\"Read\" /etc/passwd)"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for Rule: Web Shell - file 404.php

• Scenario: Automated Health Check Probing

  • Context: Cloud load balancers (e.g., AWS ALB, Azure Application Gateway) or external monitoring tools like Datadog and Pingdom frequently send HTTP GET requests to a standard endpoint named 404.php to verify web server availability. Since the file might be a placeholder or the request is part of a health check script that expects a specific response code, the creation or access of this file can trigger the rule if the logic interprets new file activity in the web root as suspicious.
  • Suggested Filter: Exclude traffic originating from known internal IP ranges (e.g., 10.x.x.x) and external monitoring service IPs where the User-Agent string contains keywords like “HealthCheck,” “Datadog,” or “Pingdom.”

• Scenario: Scheduled Backup and Cleanup Jobs

  • Context: Enterprise backup solutions such as Veeam or custom PowerShell scripts running via Windows Task Scheduler often archive web directories. During the archiving process, these tools may create temporary staging files or rename existing logs to 404.php temporarily before compression. Additionally, automated cleanup jobs might generate a default error page file named 404.php if a specific directory structure is being reset.
  • Suggested Filter: Create an exclusion based on the process name of the backup agent (e.g., Veeam.Backup.Service.exe, powershell.exe) and exclude events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where these jobs are active.

• Scenario: CMS Deployment and Theme Updates

  • Context: Content Management Systems like WordPress, Drupal, or Joomla