Web Shell - file webshell-cnseay02-1.php

Hunt Hypothesis

This detection identifies the creation of a suspicious PHP web shell file on a web server, indicating an adversary’s attempt to establish persistent access and execute commands for lateral movement or data exfiltration. The SOC team should proactively hunt for this behavior in Azure Sentinel because web shells are frequently used as initial footholds by attackers following successful exploitation of public-facing applications, allowing them to maintain stealthy control over the environment.

YARA Rule

rule webshell_webshell_cnseay02_1 {
	meta:
		description = "Web Shell - file webshell-cnseay02-1.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "95fc76081a42c4f26912826cb1bd24b1"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "(93).$_uU(41).$_uU(59);$_fF=$_uU(99).$_uU(114).$_uU(101).$_uU(97).$_uU(116).$_uU"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Web Shell detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup Script Execution

  • Context: The enterprise uses a nightly backup job (e.g., via Cron or Windows Task Scheduler) that executes a PHP script named webshell-cnseay02-1.php to archive logs and compress data before uploading to an S3 bucket. Because the file is executed by the system account rather than a web user, it triggers the rule despite being legitimate.
  • Filter/Exclusion: Add an exclusion for the specific process ID (PID) or service account running the script. For example: Exclude if Process Name = 'backup-agent' AND User Account = 'svc-backup'. Alternatively, filter by time window to only alert during non-maintenance hours (e.g., 09:00–17:00).

• Scenario: Legitimate CMS Plugin Update

  • Context: During a scheduled maintenance window, the DevOps team deploys an update for a Content Management System (CMS) like WordPress or Drupal. The deployment pipeline automatically writes and executes webshell-cnseay02-1.php as part of a health check module to verify database connectivity post-deployment.
  • Filter/Exclusion: Create a filter based on the source IP address of the deployment server (e.g., Jenkins or Azure DevOps agent). Rule: Exclude if Source IP = '10.20.30.45' (CI/CD Server). Additionally, exclude events where the HTTP User-Agent contains keywords like “Jenkins” or “Ansible”.

• Scenario: Third-Party Monitoring Tool Health Check

  • Context: An external monitoring solution such as **Datadog