This detection identifies the creation of a specific web shell artifact (PHPJackal v1.5.php) that adversaries deploy to establish persistent remote access and execute commands on compromised web servers. Proactive hunting for this signature in Azure Sentinel is critical because web shells often serve as the initial foothold for post-exploitation activities, enabling attackers to move laterally and exfiltrate sensitive data before broader detection mechanisms trigger.
rule webshell_PHPJackal_v1_5 {
meta:
description = "Web Shell - file PHPJackal v1.5.php"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
date = "2014/01/28"
score = 70
hash = "d76dc20a4017191216a0315b7286056f"
id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
strings:
$s7 = "echo \"<center>${t}MySQL cilent:</td><td bgcolor=\\\"#333333\\\"></td></tr><form"
$s8 = "echo \"<center>${t}Wordlist generator:</td><td bgcolor=\\\"#333333\\\"></td></tr"
condition:
all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 2 string patterns in its detection logic.
Here are 4 specific false positive scenarios for the Web Shell - file PHPJackal v1.5.php detection rule, along with recommended filters and exclusions:
Scheduled Backup Automation via Admin Script
PHPJackal v1.5.php utility to the web root (/var/www/html/tools) on Friday evenings at 02:00 AM to generate performance reports before the weekend.192.168.10.5) and the event timestamp falls within the maintenance window (Friday 01:30–04:00 AM).Legacy CMS Plugin Deployment by DevOps Team
PHPJackal v1.5.php into the /plugins/analytics directory as part of the standard release process for version 4.2 updates.svc-jenkins-deploy) and the destination path matches the regex /plugins/analytics/PHPJackal.*.Third-Party Analytics Integration
PHPJackal v1.5.php script to be present in the public-facing web directory (`/public/js/an