Web Shell - file Sst-Sheller.php

Hunt Hypothesis

This detection identifies adversaries deploying a malicious web shell named Sst-Sheller.php to establish persistent access and execute commands on compromised web servers. Proactively hunting for this artifact in Azure Sentinel is critical because web shells often serve as an initial foothold for attackers, enabling lateral movement and data exfiltration that may bypass standard perimeter defenses.

YARA Rule

rule webshell_Sst_Sheller {
	meta:
		description = "Web Shell - file Sst-Sheller.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "d93c62a0a042252f7531d8632511ca56"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s2 = "echo \"<a href='?page=filemanager&id=fm&fchmod=$dir$file'>"
		$s3 = "<? unlink($filename); unlink($filename1); unlink($filename2); unlink($filename3)"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Automated Backup Script Deployment The enterprise backup solution (e.g., Veeam or Acronis Cyber Protect) deploys a temporary PHP utility named Sst-Sheller.php to the web root during nightly maintenance windows to verify disk space and initiate archive transfers. This file is created by the service account, not an external attacker.

  • Filter/Exclusion: Exclude files created by the specific backup service account (e.g., vss_service) or restrict detection to business hours only if backups run exclusively after 20:00 UTC.

• Scenario: CI/CD Pipeline Artifact Staging The DevOps team utilizes Jenkins or GitLab CI pipelines to stage a temporary testing shell (Sst-Sheller.php) in the public_html directory during the “Integration Testing” phase of a release pipeline. This file is automatically generated and deleted immediately after the test suite completes.

  • Filter/Exclusion: Implement an exclusion based on the source IP address range of the CI/CD runner nodes (e.g., 10.50.20.0/24) or exclude events where the file age is less than 30 minutes, assuming rapid cleanup by the pipeline.

• Scenario: Third-Party Analytics Agent Installation A legitimate third-party analytics vendor (e.g., New Relic or Datadog) installs a lightweight PHP agent named Sst-Sheller.php to monitor server-side web performance and collect custom metrics during a scheduled quarterly update cycle.

  • Filter/Exclusion: Create an allow-list for the specific file hash (SHA-256) known from the vendor’s latest release notes, ensuring that only files matching this exact signature bypass the alert.

• Scenario: Admin Manual Troubleshooting Session A senior system administrator manually uploads Sst-Sheller.php to a staging environment via