Web Shell - file phpshell3.php

Hunt Hypothesis

This detection identifies the creation of a suspicious web shell named phpshell3.php, which adversaries often deploy to establish persistent remote access and execute commands on compromised web servers. Proactively hunting for this artifact in Azure Sentinel is critical because web shells serve as a primary foothold for attackers, enabling them to pivot laterally across the environment or exfiltrate sensitive data before traditional alerts trigger.

YARA Rule

rule webshell_phpshell3 {
	meta:
		description = "Web Shell - file phpshell3.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "76117b2ee4a7ac06832d50b2d04070b8"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s2 = "<input name=\"nounce\" type=\"hidden\" value=\"<?php echo $_SESSION['nounce'];"
		$s5 = "<p>Username: <input name=\"username\" type=\"text\" value=\"<?php echo $userna"
		$s7 = "$_SESSION['output'] .= \"cd: could not change to: $new_dir\\n\";" fullword
	condition:
		2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file phpshell3.php detection rule, including tailored filters and exclusions:

• Scenario: Legitimate Deployment of a Known Third-Party Management Tool

  • Context: The IT Operations team deploys a standard remote management utility (e.g., phpMyAdmin, Laravel Debugbar, or a custom Sitecore module) which includes a file named phpshell3.php within the /admin/tools/ directory. This file is part of the official software package and not an anomaly.
  • Suggested Filter: Create an exclusion based on the specific directory path where known tools reside.
    • Filter Logic: Exclude alerts if file_path matches ^.*\/(admin|tools|modules)\/phpshell3\.php$.

• Scenario: Scheduled Backup or Health Check Script Execution

  • Context: A nightly automated maintenance job triggered by Cron (Linux) or Windows Task Scheduler executes a diagnostic script named phpshell3.php to generate server health reports. This file is created and executed daily at 02:00 AM UTC, often triggering the rule due to its “web shell” signature despite being a static, scheduled asset.
  • Suggested Filter: Implement a time-based exclusion combined with a user context check.
    • Filter Logic: Exclude alerts occurring between 01:30 and 02:30 UTC where the source_user is svc-backup-agent or system.

• Scenario: Development Environment Testing by DevOps Engineers

  • Context: During a sprint cycle, DevOps engineers manually upload phpshell3.php to a staging environment (e.g., AWS Elastic Beanstalk or Azure App Service)