Disclosed hacktool set (old stuff) - file EDIT.ASP

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging legacy or disclosed hacking tools, specifically identified by the presence of an “EDIT.ASP” file, to detect potential reconnaissance or command-and-control activities within web-facing applications. Proactively hunting for this indicator in Azure Sentinel is critical because known tool signatures often signal early-stage intrusions where attackers utilize familiar artifacts to blend into normal traffic before executing deeper compromise actions.

YARA Rule

rule aspbackdoor_EDIT {
	meta:
		description = "Disclosed hacktool set (old stuff) - file EDIT.ASP"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "12196cf62931cde7b6cb979c07bb5cc6a7535cbb"
	strings:
		$s1 = "<meta HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html;charset=gb_2312-80\">" fullword ascii
		$s2 = "Set thisfile = fs.GetFile(whichfile)" fullword ascii
		$s3 = "response.write \"<a href='index.asp'>" fullword ascii
		$s5 = "if Request.Cookies(\"password\")=\"juchen\" then " fullword ascii
		$s6 = "Set thisfile = fs.OpenTextFile(whichfile, 1, False)" fullword ascii
		$s7 = "color: rgb(255,0,0); text-decoration: underline }" fullword ascii
		$s13 = "if Request(\"creat\")<>\"yes\" then" fullword ascii
	condition:
		5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file EDIT.ASP detection rule, along with targeted exclusion strategies:

• Legacy CMS Maintenance Script Execution

  • Scenario: The enterprise’s legacy Content Management System (e.g., a custom ASP.NET portal running on IIS 7.5) utilizes EDIT.ASP as the primary entry point for the “Content Editor” module. When content managers log in to update website banners, the file is accessed and executed by the web server process (w3wp.exe) under the application pool identity (e.g., IIS APPPOOL\LegacyCMS).
  • Filter/Exclusion: Exclude detections where the parent process is w3wp.exe AND the user context matches the specific Application Pool Identity associated with the legacy CMS.

• Scheduled Backup and Integrity Check Job

  • Scenario: A nightly scheduled task named “WebRoot_Integrity_Check” runs via Task Scheduler to verify file hashes of critical web assets. This job explicitly opens EDIT.ASP located in C:\InetPub\wwwroot\admin\tools\ using a helper utility (e.g., PowerShell or a custom .NET wrapper) to validate its structure before archiving.
  • Filter/Exclusion: Create an exclusion for the specific file path (C:\InetPub\wwwroot\admin\tools\EDIT.ASP) when triggered by the Task Scheduler service (svchost.exe or taskscheduler.exe) during the defined maintenance window (e.g., 02:00 – 04:00).

• Internal Developer Deployment Pipeline

  • Scenario: During a CI/CD deployment using Azure DevOps or Jenkins, the build agent connects to the staging environment to perform a “Smoke Test.” The pipeline script explicitly invokes