Web Shell - file remview_fix.php

Hunt Hypothesis

This detection rule identifies adversaries who have deployed a web shell named remview_fix.php to establish persistent access and execute commands on compromised web servers. A SOC team should proactively hunt for this artifact in Azure Sentinel because such files often serve as initial footholds that enable attackers to escalate privileges, exfiltrate data, or move laterally within the environment before triggering broader alerts.

YARA Rule

rule webshell_remview_fix {
	meta:
		description = "Web Shell - file remview_fix.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "a24b7c492f5f00e2a19b0fa2eb9c3697"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
		$s5 = "echo \"<P><hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n"
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for “Web Shell - file remview_fix.php”

• Scheduled Maintenance Script Execution

  • Scenario: The enterprise’s automated nightly maintenance routine, orchestrated by Ansible Tower, deploys a temporary patch script named remview_fix.php to the web server root (/var/www/html) to apply security hotfixes. This file is created and executed before being automatically deleted or archived within 15 minutes.
  • Suggested Filter: Exclude events where the source user is svc_ansible (or a specific service account) AND the file creation timestamp falls between 02:00 and 04:00 UTC on weekdays, provided the file size is under 5KB.

• CMS Plugin Update Deployment

  • Scenario: The IT team performs a routine update of the WordPress plugin “Advanced Security,” which includes a utility file named remview_fix.php used to verify database integrity during the upgrade process. This file is generated by the WP-CLI command-line tool running as the www-data user during deployment windows.
  • Suggested Filter: Create an exclusion for files created in the /wp-content/plugins/advanced-security/ directory where the parent process name is wp-cli and the action type is “Deployment” or “Update.”

• Third-Party Analytics Tool Installation

  • Scenario: The marketing department installs a new custom analytics dashboard using SAP BusinessObjects, which generates a temporary PHP wrapper file named remview_fix.php in the /reports/custom/ directory to handle initial data ingestion and view rendering. This is a standard part of their onboarding workflow for new dashboards.
  • Suggested Filter: Exclude files located within paths containing /reports/custom/ or /analytics/ where the file extension is `.php