Web Shell - file bug (1).php

Hunt Hypothesis

This detection rule identifies the creation of a suspicious PHP web shell named “bug (1).php,” which adversaries often deploy to establish persistent access and execute commands on compromised web servers. Proactive hunting for this artifact in Azure Sentinel is critical because web shells serve as a primary foothold for lateral movement and data exfiltration, allowing attackers to maintain stealthy control over the environment even after initial intrusion detection.

YARA Rule

rule webshell_PHP_bug_1_ {
	meta:
		description = "Web Shell - file bug (1).php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "91c5fae02ab16d51fc5af9354ac2f015"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "@include($_GET['bug']);" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file bug (1).php detection rule, including suggested filters and exclusions:

• Scenario: Automated CMS Backup or Migration Scripts

  • Context: Enterprise Content Management Systems (e.g., WordPress, Drupal) often run scheduled cron jobs that temporarily create a bug(1).php file to log migration progress or handle temporary data staging during nightly backups. These files are created by the system user rather than an external attacker and contain standard library includes rather than suspicious web shell payloads.
  • Suggested Filter/Exclusion: Exclude files created by specific service accounts (e.g., IIS_IUSRS, www-data) within known backup directories (e.g., /var/www/html/backups/ or \Inetpub\wwwroot\cms\_backup\). Additionally, filter out events where the file creation timestamp aligns with the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Development Team Hotfix Deployment via CI/CD Pipeline

  • Context: During a DevOps deployment cycle using tools like Jenkins, GitLab CI, or Azure DevOps, the pipeline may deploy a temporary diagnostic script named bug(1).php to verify database connectivity or API endpoints before the full release. This file is often generated dynamically by the deployment agent and deleted immediately after the health check passes.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the parent process name (e.g., jenkins-agent.exe, gitlab-runner, azure-cli) and restrict the scope to specific application folders designated for staging or hotfixes (e.g., \Staging\hotfix\_temp\).

• Scenario: Third-Party Analytics or Error Tracking Agent Initialization

  • **Context