Web Shell - file Safe mode breaker.php

Hunt Hypothesis

This detection identifies adversaries deploying a “Safe mode” web shell named breaker.php to establish persistence and execute commands on compromised Azure web servers. Proactive hunting for this specific artifact is critical in Azure Sentinel because such shells often serve as an initial foothold for lateral movement, allowing attackers to evade standard file integrity checks by leveraging safe mode configurations.

YARA Rule

rule webshell_Safe_mode_breaker {
	meta:
		description = "Web Shell - file Safe mode breaker.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "5bd07ccb1111950a5b47327946bfa194"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s5 = "preg_match(\"/SAFE\\ MODE\\ Restriction\\ in\\ effect\\..*whose\\ uid\\ is("
		$s6 = "$path =\"{$root}\".((substr($root,-1)!=\"/\") ? \"/\" : NULL)."
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file Safe mode breaker.php detection rule, including tailored filters and exclusions:

• Scenario: DevOps Deployment via CI/CD Pipeline

  • Context: The organization uses GitHub Actions or Jenkins to deploy a new version of their customer portal. During the deployment phase, the pipeline script creates Safe mode breaker.php in the /var/www/html/includes/ directory as part of the standard application bundle before the web server restarts.
  • Suggested Filter/Exclusion: Exclude file creation events where the process name is github-actions-runner, jenkins-agent, or docker-entrypoint.sh. Additionally, filter by the specific deployment directory path (e.g., /var/www/html/includes/) to ensure only files created within known application folders are ignored.

• Scenario: Scheduled Maintenance Script for Legacy Module

  • Context: A nightly cron job running a custom Python script (maintenance_runner.py) executes at 02:00 AM to refresh legacy module configurations. This script regenerates the Safe mode breaker.php file to reset session states for the “Safe Mode” feature of an internal HR portal.
  • Suggested Filter/Exclusion: Create a time-based exclusion window (e.g., 01:30 – 02:30 daily) for this specific file path. Alternatively, exclude events where the parent process is python3 or cron and the user context is the dedicated service account svc_hr_maintenance.

• Scenario: Automated Backup and Restoration Routine

  • Context: The enterprise utilizes Veeam Backup & Replication to perform incremental backups of the web server. During a restore operation triggered by an admin, Veeam restores the entire web root, which includes writing `Safe mode