Web Shell - file r57.1.4.0.php

Hunt Hypothesis

This detection identifies adversaries establishing a web shell named r57.1.4.0.php to maintain persistent access and execute commands on compromised web servers. Proactive hunting for this specific artifact is critical in Azure Sentinel because web shells often serve as the initial foothold for lateral movement and data exfiltration, requiring immediate investigation before attackers can expand their presence.

YARA Rule

rule webshell_r57_1_4_0 {
	meta:
		description = "Web Shell - file r57.1.4.0.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "574f3303e131242568b0caf3de42f325"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s4 = "@ini_set('error_log',NULL);" fullword
		$s6 = "$pass='abcdef1234567890abcdef1234567890';" fullword
		$s7 = "@ini_restore(\"disable_functions\");" fullword
		$s9 = "@ini_restore(\"safe_mode_exec_dir\");" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Web Shell - file r57.1.4.0.php detection rule, including suggested filters and exclusions:

• Scheduled Backup or Migration Scripts

  • Scenario: An automated nightly backup job (e.g., running via Cron on Linux or Task Scheduler on Windows Server) executes a PHP script named r57.1.4.0.php to archive web content or migrate database records to an off-site storage bucket. The file creation or modification triggers the rule as if it were a new shell upload.
  • Filter/Exclusion: Exclude file paths matching known backup directories (e.g., /var/www/backups/ or C:\InetPub\BackupJobs\) and restrict alerts to files created only during non-business hours (02:00–05:00 local time). Additionally, whitelist the specific hash of the legitimate r57.1.4.0.php script if it is a static component of the backup solution.

• CI/CD Pipeline Deployment Artifacts

  • Scenario: During an automated deployment window using tools like Jenkins, GitLab CI, or Azure DevOps, the pipeline pushes updated application modules to the web server. The artifact r57.1.4.0.php is part of a standard release package (version 5.7.1.4) containing utility functions, not an interactive shell.
  • Filter/Exclusion: Correlate alerts with deployment logs; exclude events where the source IP belongs to the CI/CD server range or where the user agent matches the deployment tool (e.g., Jenkins-2.401). Implement a logic check to suppress alerts if the file is created within 5 minutes of a successful pipeline completion webhook