Web Shell - file up.php

Hunt Hypothesis

This detection identifies adversaries deploying a web shell named up.php to establish a persistent foothold within web applications for command execution and data exfiltration. Proactive hunting is essential in Azure Sentinel because web shells often blend with legitimate traffic, requiring manual investigation to confirm malicious intent before attackers can escalate privileges or move laterally across the environment.

YARA Rule

rule webshell_php_up {
	meta:
		description = "Web Shell - file up.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "7edefb8bd0876c41906f4b39b52cd0ef"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "copy($HTTP_POST_FILES['userfile']['tmp_name'], $_POST['remotefile']);" fullword
		$s3 = "if(is_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'])) {" fullword
		$s8 = "echo \"Uploaded file: \" . $HTTP_POST_FILES['userfile']['name'];" fullword
	condition:
		2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file up.php detection rule, including suggested filters and exclusions:

• Scenario: Legitimate Backup Upload via Command Line Interface (CLI)

  • Context: System administrators frequently use CLI tools like curl, wget, or PowerShell to push configuration updates or backup archives directly to the web root. If a scheduled maintenance job uploads a temporary file named up.php to handle a specific migration script, the rule may flag it as a malicious shell upload.
  • Filter/Exclusion: Exclude events where the source IP belongs to the internal “Infrastructure Management” subnet (e.g., 10.50.20.0/24) and the HTTP User-Agent header matches known administration tools such as curl/7.x, PowerShell, or Ansible.

• Scenario: Deployment Pipeline Artifact in CI/CD

  • Context: In environments using Jenkins, GitLab CI, or GitHub Actions, automated deployment pipelines often stage temporary PHP scripts named up.php during the “staging” phase of a release. These files are created by the build server to verify database connectivity before the final application bundle is deployed.
  • Filter/Exclusion: Create an exclusion for file creation events originating from known CI/CD service accounts (e.g., svc-jenkins, gitlab-runner) or specific hostnames like build-server-01. Additionally, filter out files created within the /deploy-staging directory path rather than the live web root.

• Scenario: Scheduled Reporting Job Execution

  • Context: Enterprise reporting tools (such as Tableau Server connectors or custom internal analytics dashboards) often generate a temporary up.php script to aggregate daily logs or upload CSV reports from an external data lake. This process runs via a cron job