Web Shell - file odd.php

Hunt Hypothesis

This detection identifies potential web shell deployments where adversaries create or modify an “odd.php” file to establish a persistent command-and-control channel on compromised web servers. Proactive hunting for this specific artifact in Azure Sentinel is critical because web shells often serve as the initial foothold for lateral movement and data exfiltration, requiring immediate investigation before attackers can expand their access within the environment.

YARA Rule

rule webshell_phpkit_0_1a_odd {
	meta:
		description = "Web Shell - file odd.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "3c30399e7480c09276f412271f60ed01"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "include('php://input');" fullword
		$s3 = "ini_set('allow_url_include, 1'); // Allow url inclusion in this script" fullword
		$s4 = "// uses include('php://input') to execute arbritary code" fullword
		$s5 = "// php://input based backdoor" fullword
	condition:
		2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Web Shell - file odd.php” detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: CMS Plugin Updates via Command Line

  • Context: Automated deployment pipelines (e.g., Jenkins or GitHub Actions) frequently push updates to Content Management Systems like WordPress or Drupal. During these runs, the system may temporarily create or modify a file named odd.php within the /wp-content/plugins/ directory as part of a specific plugin’s configuration logic or migration script.
  • Suggested Filter: Exclude alerts where the source user is a known service account (e.g., svc-deploy, jenkins-agent) and the process name matches the deployment tool executable (e.g., java.exe for Jenkins, pwsh.exe for PowerShell scripts).

• Scenario: Scheduled Backup or Reporting Scripts

  • Context: Enterprise reporting tools often generate temporary PHP scripts to aggregate data before archiving. A nightly scheduled job running via Windows Task Scheduler might execute a script that instantiates odd.php in the web root (/var/www/html/reports/) to process CSV exports, which is then deleted immediately after execution.
  • Suggested Filter: Create an exclusion for files created by specific service accounts (e.g., svc-backup, cron-user) where the file age is less than 15 minutes and the file size remains under 2KB, indicating a transient temporary file rather than a persistent shell.

• Scenario: Third-Party Integration Webhooks

  • Context: External services (such as Salesforce, HubSpot, or Slack) often utilize webhooks to push data into the enterprise portal. These integrations may deploy a lightweight handler named odd.php in an integration subfolder (e.g., /integrations/webhook-handler/) to