Web Shell - file phpspy2010.php

Hunt Hypothesis

This detection identifies adversary behavior where a malicious PHP web shell named “phpspy2010.php” is deployed to establish a persistent foothold and enable remote command execution on web servers. A proactive hunt for this artifact in Azure Sentinel is critical because web shells often serve as the initial entry point for lateral movement, data exfiltration, and privilege escalation attacks that may evade standard signature-based defenses.

YARA Rule

rule webshell_phpspy2010 {
	meta:
		description = "Web Shell - file phpspy2010.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "14ae0e4f5349924a5047fed9f3b105c5"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s3 = "eval(gzinflate(base64_decode("
		$s5 = "//angel" fullword
		$s8 = "$admin['cookiedomain'] = '';" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file phpspy2010.php detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Backup Script Execution

  • Context: The organization utilizes a custom backup utility (e.g., Veeam Backup & Replication or a proprietary Python/PHP wrapper) that periodically generates temporary PHP scripts named phpspy2010.php within the /var/www/html/temp directory to handle log rotation and snapshot verification.
  • Filter/Exclusion: Exclude files located in specific backup directories (e.g., path: /var/www/html/temp/*) where the file owner is the service account (owner: veeam_svc) and the process creating the file is known (e.g., process_name: veeam-backup-agent).

• Scenario: Legacy Application Deployment via CI/CD Pipeline

  • Context: During nightly deployment cycles, the Jenkins or GitLab CI pipeline deploys a legacy module for the “Supply Chain Portal.” This specific module includes phpspy2010.php as a standard component of its release artifact, which is uploaded to the /opt/app/legacy-modules directory by the build agent.
  • Filter/Exclusion: Create an exclusion rule based on the deployment window and source IP. Filter alerts where the file creation event occurs between 01:00–04:00 UTC (maintenance window) AND the source IP belongs to the CI/CD subnet (source_ip: 10.20.50.x) AND the destination path matches /opt/app/legacy-modules.

• Scenario: Scheduled Diagnostic Tool by System Administrators

  • Context: The IT Operations team runs a scheduled diagnostic job using **Ansible