Web Shell - file ghost.php

Hunt Hypothesis

This detection identifies adversaries who have deployed a malicious web shell named ghost.php to establish persistence and execute commands on compromised web servers. Proactive hunting for this artifact in Azure Sentinel is critical because web shells often serve as an initial foothold that enables attackers to move laterally, exfiltrate sensitive data, or escalate privileges within the organization’s cloud infrastructure.

YARA Rule

rule webshell_php_ghost {
	meta:
		description = "Web Shell - file ghost.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "38dc8383da0859dca82cf0c943dbf16d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "<?php $OOO000000=urldecode('%61%68%36%73%62%65%68%71%6c%61%34%63%6f%5f%73%61%64'"
		$s6 = "//<img width=1 height=1 src=\"http://websafe.facaiok.com/just7z/sx.asp?u=***.***"
		$s7 = "preg_replace('\\'a\\'eis','e'.'v'.'a'.'l'.'(KmU(\"" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file ghost.php detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup or Migration Scripts

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) or migration tools often deploy temporary PHP scripts named ghost.php to verify connectivity or stage data before the main process runs. These files are created by service accounts rather than interactive users and exist only for short durations.
  • Filter/Exclusion: Exclude file creation events where the ProcessName matches known backup services (e.g., vbrservice.exe, commagent.exe) AND the user context is a dedicated service account (e.g., DOMAIN\BackupSvc). Additionally, add a time-based exclusion if the file age is less than 15 minutes and no subsequent web traffic accesses it.

• Scenario: CMS Plugin Updates or Theme Deployment

  • Context: Content Management Systems like WordPress, Drupal, or Magento frequently use ghost.php as a placeholder or staging file during plugin updates (via tools like WP-CLI or Jenkins pipelines). During automated CI/CD deployments, the deployment agent creates this file to test module loading before finalizing the release.
  • Filter/Exclusion: Create an exclusion rule for files created within specific directory paths known for CMS operations (e.g., C:\inetpub\wwwroot\wp-content\uploads\temp\). Filter events where the parent process is a deployment tool (e.g., jenkins-agent.exe, powershell.exe triggered by Azure DevOps) and the file extension remains .php.

• Scenario: Scheduled Health Check or Monitoring Probes

  • Context: Internal monitoring suites (such as Datadog, New Relic, or custom Nagios scripts) often generate a lightweight ghost.php