Web Shell - file php-backdoor.php

Hunt Hypothesis

This detection identifies adversaries who have established a persistent PHP web shell backdoor on a web server to enable remote command execution and potential lateral movement. Proactively hunting for this behavior in Azure Sentinel is critical because web shells often serve as an initial foothold that allows attackers to maintain stealthy access and exfiltrate sensitive data before triggering broader security alerts.

YARA Rule

rule webshell_php_backdoor {
	meta:
		description = "Web Shell - file php-backdoor.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fname))" fullword
		$s2 = "<pre><form action=\"<? echo $PHP_SELF; ?>\" METHOD=GET >execute command: <input "
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file php-backdoor.php detection rule, including suggested filters and exclusions:

• Scenario: Automated Deployment Pipeline Artifacts

  • Context: CI/CD tools like Jenkins, GitLab Runner, or Azure DevOps frequently deploy application updates to web servers. During these deployments, the build process may temporarily create a generic staging file named php-backdoor.php within the deployment directory before renaming it or moving it to production.
  • Suggested Filter/Exclusion: Exclude files created by specific service accounts (e.g., svc-jenkins, gitlab-runner) and restrict the detection scope to exclude standard deployment directories such as /var/www/deploy-staging or C:\IISAppPool\Temp.

• Scenario: Scheduled Security Scanning Jobs

  • Context: Enterprise vulnerability scanners like Tenable Nessus, Qualys, or OpenVAS often perform active web application testing. These tools may generate a temporary probe file named php-backdoor.php in the document root to test server response times, check for specific headers, or validate upload functionality during their scheduled nightly scans.
  • Suggested Filter/Exclusion: Create an exclusion based on the source IP addresses of the security scanning appliances and filter out events occurring only during defined maintenance windows (e.g., 02:00–04:00 UTC) where these jobs are active.

• Scenario: Legitimate Admin Maintenance Scripts

  • Context: System administrators often use custom scripts or third-party management suites like SolarWinds SiteScope or ManageEngine OpManager to perform health checks. These tools might upload a standard diagnostic script named php-backdoor.php to the web root to gather server metrics, log rotation status, or database connectivity reports.