Web Shell - file simple-backdoor.php

Hunt Hypothesis

This detection identifies adversaries deploying a PHP web shell named simple-backdoor.php to establish a persistent foothold and execute commands on compromised web servers. Proactive hunting for this indicator in Azure Sentinel is critical because web shells often serve as an initial entry point that can escalate privileges or pivot to other systems before triggering broader alerting mechanisms.

YARA Rule

rule webshell_simple_backdoor {
	meta:
		description = "Web Shell - file simple-backdoor.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "f091d1b9274c881f8e41b2f96e6b9936"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "$cmd = ($_REQUEST['cmd']);" fullword
		$s1 = "if(isset($_REQUEST['cmd'])){" fullword
		$s4 = "system($cmd);" fullword
	condition:
		2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file simple-backdoor.php detection rule, including suggested filters and exclusions:

• Scenario: Automated CMS Security Patch Deployment

  • Context: The enterprise utilizes a centralized deployment tool like Ansible or Jenkins to push security updates across all web servers. During the nightly maintenance window (e.g., 02:00 AM), the automation script extracts and deploys simple-backdoor.php as part of a standard hardening package for the WordPress or Drupal instances.
  • Filter/Exclusion: Create an exclusion based on the Source Host (the CI/CD server IP) and Time Window.
    • Logic: Exclude alerts where source_host_ip IN [10.20.5.1, 10.20.5.2] AND event_time BETWEEN '02:00' AND '04:00'.

• Scenario: Development Environment Staging by DevOps Engineers

  • Context: A DevOps engineer is manually uploading a new prototype module to the Staging Web Server (IIS/Apache) using WinSCP or FileZilla. The file simple-backdoor.php represents a legitimate utility script used for temporary debugging of API endpoints, not a malicious backdoor.
  • Filter/Exclusion: Filter by Environment Tag and User Identity.
    • Logic: Exclude alerts where environment_tag = 'Staging' AND user_account IN ['svc-devops-01', 'j.doe'].

• Scenario: Scheduled Backup Verification Job

  • Context: A custom Python script running via Windows Task Scheduler (or Cron on Linux) executes daily to verify the integrity of web directories