Web Shell - file WinX Shell.php

Hunt Hypothesis

This detection identifies adversaries deploying a “WinX Shell.php” web shell to establish persistent command-and-control access on compromised web servers within the Azure environment. Proactive hunting for this specific artifact is critical because web shells often serve as an initial foothold that enables attackers to execute arbitrary commands, exfiltrate sensitive data, and pivot laterally across the network before traditional alerts trigger.

YARA Rule

rule webshell_WinX_Shell {
	meta:
		description = "Web Shell - file WinX Shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "17ab5086aef89d4951fe9b7c7a561dda"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s5 = "print \"<font face=\\\"Verdana\\\" size=\\\"1\\\" color=\\\"#990000\\\">Filenam"
		$s8 = "print \"<font face=\\\"Verdana\\\" size=\\\"1\\\" color=\\\"#990000\\\">File: </"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file WinX Shell.php detection rule, along with suggested filters or exclusions:

• Scenario: Deployment of Official CMS Plugin via CI/CD Pipeline

  • Context: The DevOps team uses GitHub Actions to deploy a new version of the “WinX Analytics” plugin during nightly builds. The deployment script automatically creates Shell.php in the /plugins/winx-analytics/ directory as part of the standard artifact structure, which is not an anomaly but expected behavior.
  • Suggested Filter: Exclude files where the source IP belongs to the CI/CD subnet (e.g., 10.20.50.0/24) AND the file path contains /plugins/winx-analytics/.

• Scenario: Scheduled Backup and Archive Job

  • Context: A nightly maintenance job executed by Ansible Tower extracts compressed archives containing legacy configuration files. This process temporarily writes Shell.php to a staging directory (/var/www/html/staging/) before moving it to the final archive location, triggering the rule during the extraction phase.
  • Suggested Filter: Create an exclusion for file creation events occurring between 02:00 and 04:00 UTC where the parent process is ansible-playbook or the user context is backup-service.

• Scenario: Admin Manual Configuration via Remote Desktop

  • Context: A senior system administrator performs a manual hotfix on the production web server using Microsoft Remote Desktop (RDP). They manually copy and paste Shell.php from their local workstation to the /admin-tools/ directory to enable temporary diagnostic logging.
  • Suggested Filter: Exclude events where the source user is in the “SysAdmins” Active Directory group AND the file destination path starts with