Web Shell - file cmd.php

Hunt Hypothesis

This detection identifies adversaries who have deployed a cmd.php web shell to establish a persistent command-and-control channel for executing arbitrary commands on compromised web servers. Proactive hunting for this artifact in Azure Sentinel is critical because web shells often serve as an initial foothold that enables attackers to escalate privileges, exfiltrate sensitive data, and move laterally across the environment before triggering broader alerts.

YARA Rule

rule webshell_php_cmd {
	meta:
		description = "Web Shell - file cmd.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "c38ae5ba61fd84f6bbbab98d89d8a346"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "if($_GET['cmd']) {" fullword
		$s1 = "// cmd.php = Command Execution" fullword
		$s7 = "  system($_GET['cmd']);" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file cmd.php detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Deployment via CI/CD Pipeline

  • Context: During a routine release cycle, the DevOps team uses Jenkins or GitLab CI to deploy new application features. The deployment script automatically uploads a utility file named cmd.php to the /tools directory of the web server (e.g., Nginx/Apache) to assist with on-the-fly debugging and log aggregation before the final production freeze.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the source IP address of the CI/CD runner (e.g., 10.50.20.5) and restrict the file path to specific deployment directories (e.g., *[/tools/cmd.php]). Additionally, exclude events where the user agent matches known internal build tools like Jenkins or GitHub Actions.

• Scenario: Scheduled Maintenance by Admin via SSH

  • Context: A System Administrator performs a scheduled weekly maintenance window using Ansible Tower. As part of the playbook execution, Ansible pushes a temporary diagnostic script named cmd.php to the web root (/var/www/html) to verify database connectivity and cache status. This file is created by the service account svc_ansible.
  • Suggested Filter/Exclusion: Exclude events where the source_user matches known automation accounts (e.g., svc_ansible, svc_deploy) AND the event timestamp falls within the defined maintenance window (e.g., Sunday 02:00–04:00 UTC).

• Scenario: Third-Party Analytics or Monitoring Agent

  • Context: The enterprise utilizes a third-party monitoring solution like