Web Shell - file co.php

Hunt Hypothesis

This detection identifies adversaries deploying a malicious web shell named co.php to establish persistent access and execute commands on compromised web servers. SOC teams should proactively hunt for this artifact in Azure Sentinel because web shells often serve as an initial foothold for lateral movement and data exfiltration, requiring immediate investigation before attackers can fully entrench their presence.

YARA Rule

rule webshell_PHP_co {
	meta:
		description = "Web Shell - file co.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "62199f5ac721a0cb9b28f465a513874c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "cGX6R9q733WvRRjISKHOp9neT7wa6ZAD8uthmVJV" fullword
		$s11 = "6Mk36lz/HOkFfoXX87MpPhZzBQH6OaYukNg1OE1j" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Web Shell - file co.php detection rule, tailored for an enterprise environment:

• Scenario: Legitimate CMS Plugin Installation or Update

  • Context: An administrator uses a Content Management System (CMS) like WordPress, Joomla, or Drupal to install or update a plugin named “co” (e.g., contact-form-co or checkout-co). The installation process automatically creates a file named co.php in the /wp-content/plugins/ or /modules/ directory.
  • Filter/Exclusion: Exclude files located within standard CMS plugin directories from the alert logic.
    • Example Path: */wp-content/plugins/*/co.php, */joomla/components/com_*/*/co.php.

• Scenario: Scheduled Backup or Reporting Job

  • Context: An automated nightly job (e.g., a Python script using cron on Linux or Task Scheduler on Windows) generates a temporary report file named co.php to aggregate daily transaction data before archiving it. This is often part of an internal analytics pipeline where “co” stands for “consolidated output.”
  • Filter/Exclusion: Create a whitelist based on the specific user account running the job and the time window.
    • Example Filter: Exclude events where User = svc-backup-agent AND Time is between 02:00 and 04:00 UTC.

• Scenario: Deployment Pipeline Artifact

  • Context: A DevOps team utilizes a CI/CD tool (such as Jenkins, GitLab CI, or Azure DevOps) to deploy microservices. The deployment script temporarily stages a configuration wrapper named co.php in the /tmp/deploy-staging/ directory during the build phase before moving it to production