Web Shell - file idc.php

Hunt Hypothesis

This detection targets adversaries who deploy malicious web shells named idc.php to establish a persistent foothold and execute arbitrary commands on compromised web servers. Proactive hunting for this specific artifact in Azure Sentinel is critical because web shells often serve as an initial entry point for lateral movement and data exfiltration, requiring immediate investigation before the attacker can expand their presence within the environment.

YARA Rule

rule webshell_wsb_idc {
	meta:
		description = "Web Shell - file idc.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "7c5b1b30196c51f1accbffb80296395f"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "if (md5($_GET['usr'])==$user && md5($_GET['pass'])==$pass)" fullword
		$s3 = "{eval($_GET['idc']);}" fullword
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file idc.php detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup Script Execution

  • Context: The enterprise uses a custom backup utility (e.g., Veeam or Custom Python script) that periodically writes configuration logs to the web root. This process creates a temporary idc.php file in the /var/www/html/backup/ directory to store session data before archiving.
  • Filter/Exclusion: Add an exclusion for files located within specific subdirectories known for temporary data processing: Path contains "/backup/" OR Path contains "/temp/". Additionally, exclude if the file size is under 2KB and modified by the service account svc-backup-agent.

• Scenario: CMS Plugin Update Deployment

  • Context: During a scheduled maintenance window, the WordPress or Drupal content management system automatically updates a plugin named “IDC Analytics.” The deployment pipeline extracts a manifest file named idc.php into the active plugins directory (/wp-content/plugins/idc-analytics/) as part of the installation routine.
  • Filter/Exclusion: Exclude files where the parent directory matches known CMS plugin paths (e.g., /wp-content/plugins/*, /modules/custom/*). Filter by source IP, allowing only deployments originating from the CI/CD pipeline server (e.g., Source IP = 10.20.30.5 for Jenkins or GitLab Runner).

• Scenario: Scheduled Health Check Job

  • Context: A legacy monitoring tool, such as SolarWinds NPM or a custom Ansible Tower job, runs every 15 minutes to verify web server health. The job generates a diagnostic report file named `id