Web Shell - file moon.php

Hunt Hypothesis

This detection identifies adversaries deploying a malicious web shell named “moon.php” to establish persistent access and execute arbitrary commands on compromised web servers. Proactive hunting for this artifact in Azure Sentinel is critical because web shells often serve as a stealthy entry point for lateral movement and data exfiltration that may evade standard signature-based alerts.

YARA Rule

rule webshell_php_moon {
	meta:
		description = "Web Shell - file moon.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "2a2b1b783d3a2fa9a50b1496afa6e356"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s2 = "echo '<option value=\"create function backshell returns string soname"
		$s3 = "echo      \"<input name='p' type='text' size='27' value='\".dirname(_FILE_).\""
		$s8 = "echo '<option value=\"select cmdshell(\\'net user "
	condition:
		2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file moon.php detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Backup Script Execution

  • Context: The organization uses a custom backup utility (e.g., Veeam Backup & Replication or a proprietary Python script) that periodically generates a temporary status report file named moon.php in the web root (/var/www/html/reports/) to log completion metrics. This file is created by the service account and immediately deleted after processing, but the rule triggers on its creation.
  • Suggested Filter: Exclude files where the source process name matches the backup service (e.g., veeam-agent.exe or python3) AND the file path contains /reports/. Additionally, add a time-based exclusion for the specific window when backups run (e.g., 02:00–04:00 UTC).

• Scenario: CI/CD Pipeline Deployment Artifact

  • Context: During nightly deployments managed by Jenkins or GitHub Actions, the deployment pipeline deploys a standard monitoring module named moon.php as part of the application update package. This file is a legitimate component of the new version, not an injected web shell, and is deployed to the staging environment (/opt/app/staging/public/moon.php).
  • Suggested Filter: Create an exclusion for files created by CI/CD service accounts (e.g., jenkins-agent, github-actions-runner) where the destination path matches the known deployment directory structure. Include a condition that ignores events if the file size is within the expected range of the standard module (e.g., 2KB–10KB).

• Scenario: Scheduled Health Check by Monitoring Tool

  • Context: The enterprise monitoring suite, such