Disclosed hacktool set (old stuff) - file aspfile1.asp

Hunt Hypothesis

This detection identifies adversaries deploying legacy ASP-based hacking tools to establish a persistent foothold within web-facing Azure environments. Proactive hunting for this specific artifact is critical to uncover dormant threats that may evade standard modern signature rules and leverage outdated infrastructure to maintain long-term access.

YARA Rule

rule aspfile1 {
	meta:
		description = "Disclosed hacktool set (old stuff) - file aspfile1.asp"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "77b1e3a6e8f67bd6d16b7ace73dca383725ac0af"
	strings:
		$s0 = "' -- check for a command that we have posted -- '" fullword ascii
		$s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword ascii
		$s5 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"><BODY>" fullword ascii
		$s6 = "<input type=text name=\".CMD\" size=45 value=\"<%= szCMD %>\">" fullword ascii
		$s8 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword ascii
		$s15 = "szCMD = Request.Form(\".CMD\")" fullword ascii
	condition:
		3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule “Disclosed hacktool set (old stuff) - file aspfile1.asp”, including suggested filters and exclusions:

Legacy IIS Application Deployment
- Scenario: An administrator deploys a legacy web application to an internal IIS server using aspfile1.asp as the entry point, which is part of a standard “Hacktool” suite used for internal diagnostics. The file is created or modified by the IIS Express service or a deployment script running under the SYSTEM account.
- Filter/Exclusion: Exclude events where the User Account is NT AUTHORITY\SYSTEM OR DOMAIN\Administrator, and the Process Name matches w3wp.exe (World Wide Web Publishing Service) or msdeploy.exe.
Scheduled Maintenance Job Execution
- Scenario: A nightly automated maintenance job runs via Windows Task Scheduler to update static assets on the web server. The job executes a PowerShell script that regenerates aspfile1.asp as part of a routine backup and configuration sync process for the old hacktool module.
- Filter/Exclusion: Create an exclusion rule based on the Parent Process Name being svchost.exe (specifically the “Task Scheduler” service) or powershell.exe, where the File Path contains a known maintenance directory path (e.g., C:\InetPub\Scripts\Maintenance\).
Legacy Reporting Tool Integration
- Scenario: An internal legacy reporting tool (e.g., Crystal Reports or an older custom .NET wrapper) accesses the web server to generate daily PDF reports. The tool dynamically writes configuration data into aspfile1.asp during the report generation phase, triggering the file creation event.
- Filter/Exclusion: