Web Shell - file PHPRemoteView.php

Hunt Hypothesis

This rule detects adversaries establishing a persistent web shell named PHPRemoteView.php to execute remote commands and maintain access within web-facing applications. Proactive hunting for this artifact in Azure Sentinel is critical because such shells often serve as an initial foothold for lateral movement, data exfiltration, or privilege escalation that may evade standard signature-based detection.

YARA Rule

rule webshell_PHPRemoteView {
	meta:
		description = "Web Shell - file PHPRemoteView.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "29420106d9a81553ef0d1ca72b9934d9"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file PHPRemoteView.php detection rule, including suggested filters and exclusions:

• Scenario: Legitimate Deployment via CI/CD Pipeline

  • Context: During routine application updates, the DevOps team uses Jenkins or GitLab CI to deploy a new version of the remote viewing module. The pipeline explicitly creates PHPRemoteView.php as part of the standard artifact bundle for the customer portal.
  • Suggested Filter/Exclusion: Exclude file creation events where the source process is the CI/CD agent (e.g., jenkins-agent.exe, gitlab-runner) and the user context is a dedicated service account (e.g., svc-deploy).
  • Filter Logic: ProcessName IN ('jenkins-agent.exe', 'gitlab-runner') AND UserAccount CONTAINS 'svc-'

• Scenario: Scheduled Backup or Migration Job

  • Context: A nightly maintenance window runs a custom PowerShell script using Microsoft System Center Configuration Manager (SCCM) to synchronize web assets between the staging and production environments. This job copies PHPRemoteView.php to restore specific configurations without modifying the core logic.
  • Suggested Filter/Exclusion: Create an exclusion for file creation events occurring during the defined maintenance window (e.g., 02:00–04:00 UTC) initiated by the SCCM agent service account (sccm-agent).
  • Filter Logic: Time BETWEEN '02:00' AND '04:00' AND ProcessName = 'ccmexec.exe' AND UserAccount = 'sccm-agent'

• Scenario: Admin Manual Configuration via Remote Desktop

  • Context: A senior system administrator connects