Web Shell - file PHP Shell.php

Hunt Hypothesis

This detection rule identifies the creation of a suspicious PHP web shell named “Shell.php,” which adversaries often deploy to establish persistent access and execute arbitrary commands on compromised web servers. Proactively hunting for this artifact in Azure Sentinel is critical because web shells serve as a primary foothold for attackers to maintain long-term presence, exfiltrate data, and pivot deeper into the network before triggering broader alerts.

YARA Rule

rule webshell_PHP_Shell_x3 {
	meta:
		description = "Web Shell - file PHP Shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s4 = "&nbsp;&nbsp;<?php echo buildUrl(\"<font color=\\\"navy\\\">["
		$s6 = "echo \"</form><form action=\\\"$SFileName?$urlAdd\\\" method=\\\"post\\\"><input"
		$s9 = "if  ( ( (isset($http_auth_user) ) && (isset($http_auth_pass)) ) && ( !isset("
	condition:
		2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file PHP Shell.php detection rule, including suggested filters and exclusions:

• Scenario: Deployment of Official CMS Plugins or Themes

  • Context: During routine maintenance windows, DevOps teams deploy official plugins (e.g., WooCommerce, Yoast SEO) or themes via tools like Ansible, Jenkins, or GitLab CI/CD. These packages often include a file named Shell.php within their directory structure to handle background processing or API interactions.
  • Filter/Exclusion: Exclude files located in known application directories (e.g., /var/www/html/wp-content/plugins/*, /var/www/html/wp-content/themes/*) where the filename is exactly Shell.php. Additionally, filter by user context: exclude events triggered by service accounts like jenkins-bot or deploy-service.

• Scenario: Scheduled Backup and Maintenance Scripts

  • Context: Enterprise cron jobs running nightly backups or log rotation often utilize a custom PHP wrapper script named Shell.php to orchestrate database dumps (via mysqldump) or file compression. This is common in environments using cPanel, Plesk, or custom internal management portals.
  • Filter/Exclusion: Create an exclusion based on the process name and scheduled time. Filter out events where the parent process is cron (PID 1) or a specific scheduled task ID, occurring strictly between 02:00 AM and 04:00 AM local time.

• Scenario: Legitimate Admin Dashboard Functionality

  • Context: Internal IT portals or HR management systems often include an administrative module named Shell.php used for real-time server status monitoring, command execution, or log viewing by authorized administrators using Microsoft 365 or internal SSO