Web Shell - file s72 Shell v1.1 Coding.php

Hunt Hypothesis

This detection identifies adversaries deploying a specific “s72 Shell v1.1” web shell to establish persistent access and execute commands on compromised web servers. Proactive hunting for this artifact in Azure Sentinel is critical because web shells often serve as an initial foothold for lateral movement and data exfiltration, requiring immediate investigation before the adversary can expand their presence within the environment.

YARA Rule

rule webshell_s72_Shell_v1_1_Coding {
	meta:
		description = "Web Shell - file s72 Shell v1.1 Coding.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "c2e8346a5515c81797af36e7e4a3828e"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s5 = "<font face=\"Verdana\" style=\"font-size: 8pt\" color=\"#800080\">Buradan Dosya "
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file s72 Shell v1.1 Coding.php detection rule, including suggested filters and exclusions:

Legitimate Scenario: The DevOps team utilizes Jenkins CI/CD pipelines to deploy a standard “s72” utility module during nightly builds. The pipeline script explicitly copies the Coding.php file into the /var/www/html/tools/ directory as part of the deployment artifact, which matches the rule’s signature for a known web shell structure.
- Suggested Filter: Exclude files created by the service account used by Jenkins (e.g., svc-jenkins-build) within the specific path /var/www/html/tools/.
Legitimate Scenario: The internal IT administration team runs a scheduled PowerShell script via Task Scheduler every Monday at 2:00 AM to update legacy documentation portals. This script generates the s72 Shell v1.1 Coding.php file in the /admin/reports/ directory as a temporary reporting engine component, not a malicious shell.
- Suggested Filter: Create an exclusion for files created by the host process powershell.exe (or specific PID range) during the defined maintenance window (Mon 02:00–04:00 AM).
Legitimate Scenario: The organization’s ServiceNow instance triggers a custom integration workflow that pushes configuration updates to the web server. This workflow invokes an API call that writes the Coding.php file to /integrations/service-now/ as part of a standard synchronization routine for asset management.
- Suggested Filter: Exclude events where the source IP belongs to the ServiceNow appliance subnet (e.g., 10.20.50.x) and the destination path contains /integrations/service-now/.
**Leg