Suspicious: Might be PHP webshell includer, check the included file

Hunt Hypothesis

This detection identifies potential PHP webshell activity where an adversary utilizes dynamic file inclusion to execute malicious payloads within a web application environment. Proactive hunting for this behavior in Azure Sentinel is critical to rapidly identify and isolate compromised endpoints before attackers establish persistence or escalate privileges through the injected shell.

YARA Rule

rule WEBSHELL_PHP_Includer_Tiny
{
    meta:
        description = "Suspicious: Might be PHP webshell includer, check the included file"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        score = 75
        date = "2021/04/17"
        modified = "2023-07-05"
        hash = "0687585025f99596508783b891e26d6989eec2ba"
        hash = "9e856f5cb7cb901b5003e57c528a6298341d04dc"
        hash = "b3b0274cda28292813096a5a7a3f5f77378b8905205bda7bb7e1a679a7845004"

        id = "9bf96ddc-d984-57eb-9803-0b01890711b5"
    strings:
        $php_include1 = /include\(\$_(GET|POST|REQUEST)\[/ nocase wide ascii

        //strings from private rule capa_php_old_safe
        $php_short = "<?" wide ascii
        // prevent xml and asp from hitting with the short tag
        $no_xml1 = "<?xml version" nocase wide ascii
        $no_xml2 = "<?xml-stylesheet" nocase wide ascii
        $no_asp1 = "<%@LANGUAGE" nocase wide ascii
        $no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
        $no_pdf = "<?xpacket"

        // of course the new tags should also match
        // already matched by "<?"
        $php_new1 = /<\?=[^?]/ wide ascii
        $php_new2 = "<?php" nocase wide ascii
        $php_new3 = "<script language=\"php" nocase wide ascii

    condition:
        filesize < 100 and (
            (
                (
                        $php_short in (0..100) or
                        $php_short in (filesize-1000..filesize)
                )
                and not any of ( $no_* )
            )
            or any of ( $php_new* )
        )
        and any of ( $php_include* )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 10 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Suspicious: Might be PHP webshell includer rule, including suggested filters and exclusions tailored to an enterprise environment:

• Scenario: Automated CMS Plugin Updates via Cron Job

  • Context: Scheduled maintenance tasks in systems like WordPress or Magento often trigger background scripts that dynamically include plugin configuration files (e.g., wp-includes/class-wp-plugin.php) during the update process. These legitimate includes can mimic the behavior of a webshell loading external modules.
  • Filter/Exclusion: Exclude processes running under the specific service account associated with the CMS cron daemon (e.g., www-data or nginx on Linux, IIS APPPOOL\DefaultAppPool on Windows) where the included file path matches known CMS directory structures (e.g., paths containing /wp-content/plugins/ or /magento/var/cache/).

• Scenario: CI/CD Pipeline Artifact Deployment

  • Context: During deployment windows, tools like Jenkins, GitLab CI, or GitHub Actions execute PHP scripts to validate build artifacts. These scripts often use include() or require() to load shared utility libraries located in a temporary staging directory before finalizing the release.
  • Filter/Exclusion: Create an exclusion rule for processes initiated by known CI/CD agents (e.g., jenkins-agent, gitlab-runner) where the source file path resides within a designated build or staging folder (e.g., /var/lib/jenkins/workspace/ or C:\Builds\Staging\).

• Scenario: Legitimate Admin Dashboard Reporting Tools

  • Context: Internal business intelligence tools (such as custom dashboards built on Laravel or Symfony) often generate daily reports by including heavy data processing libraries. When an administrator manually triggers a “Generate Report” action, the system loads multiple `.