Web Shell - file r57142.php

Hunt Hypothesis

This detection identifies potential adversary persistence and command execution activities through the deployment of a suspicious web shell named r57142.php within the web server environment. Proactive hunting for this artifact in Azure Sentinel is critical to rapidly identify unauthorized entry points that could serve as a foothold for lateral movement or data exfiltration before they escalate into a broader compromise.

YARA Rule

rule webshell_PHP_r57142 {
	meta:
		description = "Web Shell - file r57142.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "0911b6e6b8f4bcb05599b2885a7fe8a8"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "$downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Web Shell - file r57142.php detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup Script Execution by Admin Tools

  • Context: Enterprise backup solutions like Veeam or Acronis Cyber Protect often deploy temporary PHP scripts to the web root for incremental reporting or log aggregation. The file r57142.php is frequently generated as a unique session token during these scheduled nightly jobs (e.g., running at 02:00 AM via Windows Task Scheduler).
  • Suggested Filter/Exclusion: Create an exclusion rule that ignores alerts where the source process name matches Veeam.Backup.Service.exe or Acronis.Agent.exe, and the file creation timestamp falls within a defined maintenance window (e.g., 01:00–04:00 local time).

• Scenario: CI/CD Pipeline Deployment of Monitoring Agents

  • Context: DevOps teams using Jenkins or Azure DevOps pipelines often deploy lightweight monitoring agents to the web server during deployment phases. The file r57142.php may be a standard artifact uploaded by the Ansible automation engine to verify connectivity before full application rollout.
  • Suggested Filter/Exclusion: Implement a filter that suppresses alerts if the user context is a service account (e.g., svc_ci_cd_deploy) and the file hash matches a known good baseline stored in the configuration management database (CMDB).

• Scenario: Third-Party Analytics or A/B Testing Tool Installation

  • Context: Marketing teams often utilize tools like Google Optimize, Optimizely, or Adobe Target which inject dynamic PHP scripts into the web root for real