Web Shell - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php

Hunt Hypothesis

This detection identifies adversaries deploying malicious web shells that exploit specific PHP version vulnerabilities to bypass safe mode restrictions and establish a persistent command-and-control foothold on compromised servers. Proactive hunting for this behavior in Azure Sentinel is critical because these web shells often operate with low visibility, allowing attackers to execute arbitrary code and exfiltrate sensitive data before traditional alerts trigger.

YARA Rule

rule webshell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2 {
	meta:
		description = "Web Shell - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "49ad9117c96419c35987aaa7e2230f63"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "die(\"\\nWelcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy\\n"
		$s1 = "Mode Shell v1.0</font></span></a></font><font face=\"Webdings\" size=\"6\" color"
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are the documented false positive scenarios for the Web Shell - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php detection rule:

• Legacy CMS Plugin Updates via Deployment Pipeline

  • Scenario: During scheduled nightly maintenance windows, the DevOps team uses Ansible or Jenkins to deploy updates to a legacy WordPress or Drupal instance running on an older PHP version (4.x/5.x). The deployment script extracts archives and creates temporary .php files in the wp-content/uploads directory that mimic the Safe_Mode bypass signature.
  • Suggested Filter: Exclude file creation events where the source process is jenkins-agent, ansible-runner, or gitlab-runner and the destination path contains /uploads/ or /plugins/.

• Automated Backup and Archiving Jobs

  • Scenario: The enterprise backup solution, such as Veeam or Commvault, performs incremental backups of the web server’s document root. The backup agent creates temporary staging files with .php extensions to verify integrity before archiving, triggering the rule due to the file naming convention and PHP version context.
  • Suggested Filter: Create an exclusion for events generated by service accounts named svc_backup, vc_agent, or commvault_service when the action is “File Created” within the root web directory during defined backup windows (e.g., 02:00–04:00 UTC).

• Third-Party Analytics and Monitoring Agents

  • Scenario: Real-time monitoring tools like New Relic, Dynatrace, or Splunk Universal Forwarder inject small PHP probe scripts into the web root to measure application performance. These agents periodically write diagnostic .php files that utilize Safe_Mode bypass techniques for environment variable inspection, causing