Web Shell - file zip.php

Hunt Hypothesis

This detection identifies adversaries deploying a web shell named zip.php to establish a persistent foothold and execute commands on compromised web servers. Proactive hunting for this specific artifact in Azure Sentinel is critical because web shells often serve as an initial entry point that enables attackers to move laterally, exfiltrate data, or escalate privileges before triggering broader alerting mechanisms.

YARA Rule

rule webshell_php_dodo_zip {
	meta:
		description = "Web Shell - file zip.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "b7800364374077ce8864796240162ad5"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "$hexdtime = '\\x' . $dtime[6] . $dtime[7] . '\\x' . $dtime[4] . $dtime[5] . '\\x"
		$s3 = "$datastr = \"\\x50\\x4b\\x03\\x04\\x0a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file zip.php detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Backup Archiving by Admin Tools

  • Context: System administrators or backup agents (e.g., Veeam, Commvault) frequently generate temporary .zip archives of log files or configuration snapshots directly in the web root directory. These tools often name the output file zip.php to indicate a PHP-based compression utility before renaming it upon completion.
  • Filter/Exclusion: Create an exclusion based on the Source User Account (e.g., svc_backup, admin_automation) and limit the detection window to specific maintenance windows (e.g., 02:00–04:00 UTC). Additionally, exclude files where the HTTP Method is POST but the Content-Type header indicates a binary stream upload rather than an interactive web request.

• Scenario: CI/CD Pipeline Deployment Artifacts

  • Context: During automated deployment cycles using tools like Jenkins, GitLab CI, or Azure DevOps, the pipeline may temporarily stage a zip.php script to bundle and transfer application modules to the staging environment before finalizing the build. This file often exists briefly as part of the “staging” phase.
  • Filter/Exclusion: Implement a filter that excludes events originating from known CI/CD Service IPs (e.g., internal Jenkins controller IP ranges). Furthermore, add a logic check to exclude files where the File Age is less than 15 minutes, assuming legitimate deployment artifacts are transient.

• Scenario: Scheduled Reporting Jobs Generating Downloadable Reports

  • Context: Enterprise reporting suites (such as Tableau Server or custom internal dashboards) often run nightly jobs that generate downloadable reports in .zip format