Web Shell - file config.php

Hunt Hypothesis

This detection identifies adversaries deploying a malicious web shell named config.php to establish persistent access and execute commands on compromised Azure web servers. Proactive hunting for this specific artifact is critical because attackers often disguise web shells as legitimate configuration files to evade standard file integrity checks, enabling them to maintain long-term footholds within the environment.

YARA Rule

rule webshell_phpshell_2_1_config {
	meta:
		description = "Web Shell - file config.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "bd83144a649c5cc21ac41b505a36a8f3"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "; (choose good passwords!).  Add uses as simple 'username = \"password\"' lines." fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file config.php detection rule, including suggested filters and exclusions:

• Automated CMS Deployment via CI/CD Pipelines

  • Scenario: During a routine deployment, a Jenkins or GitHub Actions pipeline pushes updated config.php files to the web server (e.g., Apache/Nginx) as part of a standard release process. The file is created or modified by the build agent user rather than an interactive login, often containing sensitive database credentials that trigger the “suspicious configuration change” logic.
  • Filter/Exclusion: Exclude events where the Source User matches the CI/CD service account (e.g., svc-jenkins, github-actions) or where the Process Name is the deployment tool executable (e.g., jenkins-agent.exe, kubectl).

• Scheduled Backup and Configuration Sync Jobs

  • Scenario: A nightly scheduled task runs a custom PowerShell script or a cron job to synchronize configuration settings across multiple web servers. This job reads, modifies, and writes to config.php to ensure consistency before the maintenance window closes, generating file creation/modification alerts that mimic manual shell activity.
  • Filter/Exclusion: Create an exclusion based on the Process Command Line containing specific backup keywords (e.g., “sync-config”, “backup-agent”) or filter by time windows (e.g., exclude events occurring between 02:00 and 04:00 UTC) where these jobs are known to run.

• Web Server Configuration Management Tools

  • Scenario: Administrators use configuration management tools like Ansible, Puppet, or Chef to apply infrastructure-as-code changes. These agents frequently update config.php to rotate API keys or adjust feature flags without human intervention at the moment of change, triggering the web shell