Web Shell - file odd.php

Hunt Hypothesis

This detection rule identifies the creation of a suspicious web shell named “odd.php,” which adversaries often deploy to establish a persistent foothold and execute commands on compromised web servers. Proactively hunting for this artifact in Azure Sentinel is critical because web shells serve as a primary entry point for post-exploitation activities, enabling attackers to maintain access and pivot deeper into the network before triggering broader alerts.

YARA Rule

rule webshell_phpkit_1_0_odd {
	meta:
		description = "Web Shell - file odd.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "594d1b1311bbef38a0eb3d6cbb1ab538"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "include('php://input');" fullword
		$s1 = "// No eval() calls, no system() calls, nothing normally seen as malicious." fullword
		$s2 = "ini_set('allow_url_include, 1'); // Allow url inclusion in this script" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file odd.php detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Backup or Migration Scripts

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) or migration tools often create temporary PHP scripts in the web root to handle data synchronization or status reporting. A script named odd.php might be generated by a custom migration job running via a scheduled task on the IIS/Apache server.
  • Filter/Exclusion: Exclude files where the parent directory is known backup/migration folders (e.g., /var/www/html/backups/, /inetpub/wwwroot/migration_temp). Additionally, filter out events where the process name matches specific service accounts like VeeamBackupSvc or CommvaultAgent.

• Scenario: DevOps Deployment Artifacts

  • Context: During CI/CD pipelines (using Jenkins, GitLab CI, or Azure DevOps), deployment agents often drop temporary diagnostic files into the web directory to verify connectivity before the full application rollout. A file named odd.php could be a standard health-check artifact deployed by the pipeline tool.
  • Filter/Exclusion: Create an exclusion based on the user context. If the file creation event is triggered by service accounts such as SYSTEM, IIS_IUSRS, or specific CI/CD runners (e.g., jenkins-agent-01), mark it as benign. Alternatively, exclude files created within a known deployment window (e.g., 02:00–04:00 UTC) in the /deploy_staging directory.

• Scenario: Third-Party Analytics or Monitoring Plugins

  • Context: Organizations often install third-party monitoring agents (like Datadog, New Rel