Web Shell - file Worse Linux Shell.php

Hunt Hypothesis

This detection identifies adversaries deploying a malicious web shell named “Worse Linux Shell.php” to establish a persistent foothold and execute commands on compromised web servers. SOC teams should proactively hunt for this artifact in Azure Sentinel because web shells are frequently used as an initial entry point for lateral movement, data exfiltration, and command-and-control activities that often evade standard signature-based defenses.

YARA Rule

rule webshell_Worse_Linux_Shell_1 {
	meta:
		description = "Web Shell - file Worse Linux Shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		old_rule_name = "webshell_Worse_Linux_Shell"
		score = 70
		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "system(\"mv \".$_FILES['_upl']['tmp_name'].\" \".$currentWD"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file Worse Linux Shell.php detection rule, including tailored filters and exclusions:

• Scenario: Automated CMS Deployment via CI/CD Pipeline

  • Context: The DevOps team uses Jenkins or GitLab CI to deploy a new version of a WordPress site. During the deployment phase, the pipeline script extracts a tarball containing Shell.php into the web root directory (/var/www/html/wp-content/plugins/security-tools/) as part of a standard security plugin update.
  • Filter/Exclusion: Exclude file creation events where the source process is the CI runner (e.g., jenkins-agent, gitlab-runner) or the user context is a dedicated service account (e.g., svc-deploy).
    • Logic: Exclude if ProcessName IN ('jenkins-agent', 'gitlab-runner') AND UserAccount = 'svc-deploy'.

• Scenario: Scheduled Backup and Restoration Routine

  • Context: A nightly backup job using Veeam or a custom Python script running under the root user restores a previous state of the web server. The restoration process overwrites existing files, including Shell.php, which triggers the “new file” or “file modification” logic in the detection rule even though it is a routine operation.
  • Filter/Exclusion: Create an exclusion for events occurring during the defined maintenance window (e.g., 02:00–04:00 UTC) where the source process matches known backup tools.
    • Logic: Exclude if EventTime BETWEEN '02:00' AND '04:00' AND ProcessName IN ('veeam-agent', 'restore-script.py').

• **Scenario: Legitimate Security Tool Installation by