Web Shell - file redcod.php

Hunt Hypothesis

This detection identifies potential web shell deployments where adversaries establish a persistent backdoor via a newly created redcod.php file to enable remote command execution and data exfiltration. Proactive hunting for this artifact in Azure Sentinel is critical because web shells often serve as the initial foothold for lateral movement, allowing attackers to maintain stealthy access even after the initial compromise vector has been remediated.

YARA Rule

rule webshell_PHP_redcod {
	meta:
		description = "Web Shell - file redcod.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "5c1c8120d82f46ff9d813fbe3354bac5"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "H8p0bGFOEy7eAly4h4E4o88LTSVHoAglJ2KLQhUw" fullword
		$s1 = "HKP7dVyCf8cgnWFy8ocjrP5ffzkn9ODroM0/raHm" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file redcod.php detection rule, including tailored filters and exclusions:

• Scenario: Legitimate CMS Plugin Updates via Scheduled Tasks

  • Context: An automated nightly job using Ansible or Cron deploys a new version of a custom plugin named redcod.php to the /wp-content/plugins/ directory on an Apache/Nginx web server. The file is created by a known service account (svc-deploy) rather than a user interaction, mimicking the behavior of a dropped web shell.
  • Filter/Exclusion: Exclude file creation events where the Process_Name matches ansible-playbook, cron, or systemd-tmpfiles AND the Source_Directory contains /wp-content/plugins/. Additionally, whitelist the specific SHA256 hash of the known good redcod.php artifact used in the deployment pipeline.

• Scenario: Developer Deployment via CI/CD Pipeline

  • Context: The Jenkins or GitLab Runner agent executes a post-build script that copies redcod.php (a reporting utility) into the production web root (/var/www/html/reports). This is a standard part of the release workflow triggered by a GitHub Actions run, not an anomalous user upload.
  • Filter/Exclusion: Create an exclusion rule for file creation events where the Parent_Process_Name is jenkins-agent, gitlab-runner, or github-actions. Ensure the User_Account matches the CI service identity (e.g., svc-cicd) and the destination path includes /var/www/html/.

• Scenario: Automated Backup and Restoration Routine

  • Context: A nightly backup restoration process using Veeam or Commvault restores