Web Shell - file pwhash.php

Hunt Hypothesis

This detection identifies adversary behavior where a malicious web shell named pwhash.php is deployed to establish persistence and execute commands on compromised web servers. A SOC team should proactively hunt for this artifact in Azure Sentinel because such shells often serve as an initial foothold for attackers to escalate privileges, exfiltrate sensitive data, or move laterally within the network before triggering broader alerts.

YARA Rule

rule webshell_phpshell_2_1_pwhash {
	meta:
		description = "Web Shell - file pwhash.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "ba120abac165a5a30044428fac1970d8"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "<tt>&nbsp;</tt>\" (space), \"<tt>[</tt>\" (left bracket), \"<tt>|</tt>\" (pi"
		$s3 = "word: \"<tt>null</tt>\", \"<tt>yes</tt>\", \"<tt>no</tt>\", \"<tt>true</tt>\","
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file pwhash.php detection rule, including targeted filters and exclusions:

• Scenario: Automated Password Hash Migration Script

  • Context: The Identity & Access Management (IAM) team deploys a nightly scheduled job using Ansible or PowerShell to migrate legacy user password hashes from an on-premise AD to the cloud. This process creates pwhash.php in the /var/www/html/migration/ directory as part of the staging workflow.
  • Filter/Exclusion: Exclude files created by specific service accounts (e.g., svc-iam-migrate) within the migration subdirectory, or filter out events where the user agent is identified as Ansible-Pull or PowerShell Core.

• Scenario: CI/CD Pipeline Artifact Deployment

  • Context: During a routine deployment via Jenkins or GitLab CI, the build pipeline pushes a temporary utility script named pwhash.php to the web root (/var/www/html/tools/) to validate hash integrity before the main application release. This file is generated dynamically and deleted immediately after the pipeline completes.
  • Filter/Exclusion: Exclude events originating from the CI/CD build server IP range (e.g., 10.20.50.x) or filter by process name where the parent process is jenkins-agent or gitlab-runner.

• Scenario: Third-Party Security Scanning Tool

  • Context: The enterprise uses Qualys or Tenable Nessus for vulnerability assessments. During a scheduled scan, the agent drops a temporary pwhash.php file in the web server’s document root to test specific hashing algorithms and verify SSL/TLS configurations against password storage mechanisms.