Web Shell - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php

Hunt Hypothesis

This detection identifies adversaries deploying obfuscated web shells with deceptive filenames to establish persistent backdoor access on Azure-hosted web servers. A proactive hunt is essential because these disguised files often evade standard signature-based controls, allowing attackers to execute arbitrary commands and pivot through the environment undetected.

YARA Rule

rule webshell_SimAttacker_Vrsion_1_0_0_priv8_4_My_friend {
	meta:
		description = "Web Shell - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s2 = "echo \"<a href='?id=fm&fchmod=$dir$file'><span style='text-decoration: none'><fo"
		$s3 = "fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Web Shell detection rule, including targeted filters and exclusions:

• Scenario: DevOps Deployment via CI/CD Pipeline

  • Context: A Jenkins or GitHub Actions pipeline executes a deployment script that copies a new version of My friend.php (containing metadata like “SimAttacker - Vrsion 1.0.0”) to the web root directory during nightly builds. The file name and content structure mimic the signature of a malicious shell uploaded by an attacker.
  • Filter/Exclusion: Exclude files created or modified by specific service accounts (e.g., svc-jenkins-deploy, github-actions-runner) within the deployment window (e.g., 02:00–04:00 UTC). Add a rule to ignore events where the source IP belongs to the internal CI/CD subnet.

• Scenario: Automated Backup and Archiving Job

  • Context: A scheduled Windows Task or cron job runs daily at 03:00 AM to archive log files and configuration scripts. The backup utility (e.g., Veeam, Commvault) extracts a compressed package containing My friend.php with the specific version string “SimAttacker - Vrsion 1.0.0” into a temporary staging folder before moving it to long-term storage.
  • Filter/Exclusion: Create an exclusion for file creation events occurring in the backup staging directory (e.g., C:\BackupStaging\ or /var/tmp/archive). Filter by process name, excluding known backup agents like vss.exe, commvault-agent, or rsync.

• Scenario: Third-Party Plugin Installation by Admin

  • Context: A system administrator manually installs a legitimate third-party analytics plugin named “SimAttacker” via the