Web Shell - file 404.php

Hunt Hypothesis

This detection identifies adversaries establishing a persistent web shell named “404.php” to execute commands and maintain access on compromised web servers. Proactive hunting for this specific artifact in Azure Sentinel is critical because attackers often disguise malicious shells with standard filenames like 404.php to evade routine monitoring and facilitate lateral movement within the environment.

YARA Rule

rule webshell_php_404 {
	meta:
		description = "Web Shell - file 404.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "ced050df5ca42064056a7ad610a191b3"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "$pass = md5(md5(md5($pass)));" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are the documented false positive scenarios for the Web Shell - file 404.php detection rule, including specific triggers and recommended filters:

• Scheduled Maintenance Script Execution

  • Scenario: The organization’s DevOps team utilizes a nightly maintenance script (e.g., cron job running via systemd) that deploys a temporary diagnostic page named 404.php to the web root. This file is used by internal monitoring tools like Datadog or New Relic to verify server health and uptime before being automatically deleted after 1 hour.
  • Filter/Exclusion: Exclude alerts where the source IP belongs to the internal maintenance subnet (e.g., 10.50.x.x) AND the file creation timestamp falls within the scheduled maintenance window (e.g., 02:00–04:00 UTC). Additionally, filter out events where the file size is under 5KB and the HTTP status code immediately following creation is 200 from a known health-check user agent.

• Legacy CMS Error Page Customization

  • Scenario: The enterprise uses an older version of WordPress or Drupal where the default error handling module automatically generates a custom 404.php file in the /wp-content/themes/custom-theme/ directory during theme updates or plugin installations. This is a standard administrative task performed by the Content Management team using the CMS dashboard, not an external intrusion attempt.
  • Filter/Exclusion: Create an exclusion rule for any 404.php creation occurring within specific known directories (e.g., *themes/*, */plugins/*/) and where the parent directory is owned by the www-data or iis_iusr service account.

• CI/CD Pipeline Artifact Deployment

  • Scenario: During a