Web Shell - file c37.php

Hunt Hypothesis

This detection identifies adversaries deploying a web shell named c37.php to establish persistent access and execute commands on compromised web servers. Proactive hunting for this specific artifact in Azure Sentinel is critical because web shells often serve as an initial foothold for lateral movement and data exfiltration, requiring immediate investigation before attackers can expand their presence.

YARA Rule

rule webshell_PHP_c37 {
	meta:
		description = "Web Shell - file c37.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "d01144c04e7a46870a8dd823eb2fe5c8"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s3 = "array('cpp','cxx','hxx','hpp','cc','jxx','c++','vcproj'),"
		$s9 = "++$F; $File = urlencode($dir[$dirFILE]); $eXT = '.:'; if (strpos($dir[$dirFILE],"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file c37.php detection rule, including suggested filters and exclusions:

• Scheduled Backup Script Execution

  • Scenario: The enterprise uses a custom backup utility (e.g., Veeam or a Python script running via cron) that generates temporary PHP artifacts named c37.php in the web root (/var/www/html/uploads/) during nightly maintenance windows to archive session logs.
  • Filter/Exclusion: Exclude files located within specific backup directories (e.g., /uploads/backups/*) and restrict alerts to business hours only, or exclude events where the source user is a dedicated service account like svc-backup.

• CI/CD Pipeline Deployment

  • Scenario: During an automated deployment via Jenkins or GitHub Actions, the pipeline deploys a standard configuration module named c37.php to the staging environment. This file is part of the approved artifact repository and is uploaded by the deploy-bot service account, not a human administrator.
  • Filter/Exclusion: Create an exclusion for files created or modified by known CI/CD service principals (e.g., github-actions, jenkins-agent) and restrict the rule to exclude files with a specific hash signature that matches the known good version of c37.php.

• CMS Plugin Installation

  • Scenario: An administrator installs a new plugin for the organization’s WordPress or Drupal instance. The plugin installer automatically creates a helper file named c37.php within the /wp-content/plugins/ directory to handle image processing logic. This is a standard, expected behavior during routine CMS maintenance.
  • Filter/Exclusion: Exclude any file creation events occurring in known CMS plugin directories (e.g., */plugins/*, `