Web Shell - file h6ss.php

Hunt Hypothesis

This detection rule identifies the creation of a suspicious web shell named “h6ss.php,” which adversaries often deploy to establish persistent access and execute commands on compromised web servers. Proactively hunting for this artifact in Azure Sentinel is critical because web shells serve as a primary foothold for attackers, enabling them to move laterally across the environment and exfiltrate sensitive data before traditional alerts trigger.

YARA Rule

rule webshell_php_h6ss {
	meta:
		description = "Web Shell - file h6ss.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "272dde9a4a7265d6c139287560328cd5"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "<?php eval(gzuncompress(base64_decode(\""
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file h6ss.php detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup Script Execution

  • Context: The enterprise uses a custom backup utility (e.g., Veeam or a proprietary Python script) that periodically writes temporary PHP logs to the web root directory. The file h6ss.php is generated as a transient report artifact during nightly maintenance windows, mimicking the behavior of a deployed web shell.
  • Filter/Exclusion: Create an exclusion rule based on Source Process Name and Time Window. Exclude alerts where the source process is vbr.exe (Veeam) or python.exe running between 02:00 and 04:00 UTC. Additionally, filter out files with a creation timestamp older than 1 hour that are located in a dedicated /backup-reports/ subdirectory rather than the main web root.

• Scenario: CI/CD Pipeline Deployment Artifact

  • Context: During a routine deployment via Jenkins or Azure DevOps, the pipeline deploys a health-check utility named h6ss.php to the staging environment as part of the “Post-Deployment Verification” stage. This file is automatically created by the build agent and subsequently removed after validation, triggering the rule before cleanup occurs.
  • Filter/Exclusion: Implement an exclusion based on User Account and Directory Path. Exclude alerts generated by service accounts such as svc-jenkins-build or azure-devops-agent. Furthermore, restrict the detection scope to exclude files located within the /deploy-staging/ directory, ensuring only unexpected files in the live production root trigger the alert.

• Scenario: Scheduled Health Monitor Job

  • Context: A scheduled task managed