Web Shell - file fbi.php

Hunt Hypothesis

This detection identifies adversaries establishing a persistent web shell named fbi.php to execute commands and maintain access within compromised Azure web applications. Proactive hunting for this specific artifact is critical because attackers often disguise malicious shells with legitimate-sounding filenames like “fbi” to evade standard file integrity checks and delay discovery of post-exploitation activities.

YARA Rule

rule webshell_php_fbi {
	meta:
		description = "Web Shell - file fbi.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "1fb32f8e58c8deb168c06297a04a21f1"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s7 = "erde types','Getallen','Datum en tijd','Tekst','Binaire gegevens','Netwerk','Geo"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file fbi.php detection rule, including suggested filters and exclusions:

• Scenario: Legitimate Backup or Migration Utility Deployment

  • Context: System administrators often deploy temporary PHP scripts named fbi.php (e.g., “File Backup Interface”) during scheduled maintenance windows to migrate data between on-premise servers and cloud storage. Tools like Ansible, Chef, or custom PowerShell scripts may upload this file to the web root (/var/www/html) before execution.
  • Filter/Exclusion: Exclude files created by specific service accounts (e.g., svc_ansible, admin_migration) within a defined time window (e.g., 02:00–04:00 UTC). Additionally, filter out events where the file hash matches a known baseline of the utility script stored in your CMDB.

• Scenario: Automated Reporting Dashboard Initialization

  • Context: Enterprise reporting tools such as Tableau Server, Power BI Gateway, or internal analytics platforms often generate dynamic PHP wrappers to serve dashboards. A scheduled job running via cron on a Linux web server might instantiate fbi.php (standing for “Financial Business Intelligence”) daily at 08:00 AM to refresh data views for the finance department.
  • Filter/Exclusion: Create an exclusion rule based on the file’s parent directory path (e.g., /opt/reports/dashboards) and restrict alerts to only trigger if the file is modified by a user account that is not in the “Reporting Services” group or if the file size remains static after initial creation.

• Scenario: Third-Party Integration Plugin Installation

  • Context: When integrating with external vendors (e.g., Salesforce, ServiceNow, or **Workday