Disclosed hacktool set (old stuff) - file aspfile2.asp

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging legacy ASP-based hacktools to establish persistence or execute reconnaissance within web-facing Azure environments. Proactively hunting for this specific artifact in Azure Sentinel is critical because outdated ASP files often contain known vulnerabilities that attackers exploit to maintain a low-profile foothold before escalating their operations.

YARA Rule

rule aspfile2 {
	meta:
		description = "Disclosed hacktool set (old stuff) - file aspfile2.asp"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "14efbc6cb01b809ad75a535d32b9da4df517ff29"
	strings:
		$s0 = "response.write \"command completed success!\" " fullword ascii
		$s1 = "for each co in foditems " fullword ascii
		$s3 = "<input type=text name=text6 value=\"<%= szCMD6 %>\"><br> " fullword ascii
		$s19 = "<title>Hello! Welcome </title>" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule “Disclosed hacktool set (old stuff) - file aspfile2.asp”, along with suggested filters and exclusions:

• Legacy Inventory Management System Maintenance

  • Scenario: The enterprise’s on-premise inventory system, hosted on an older IIS server, automatically generates a temporary aspfile2.asp report during nightly batch processing to reconcile stock levels. This file is created by the application service account rather than a user interaction.
  • Filter/Exclusion: Exclude files matching the path pattern C:\InetPub\wwwroot\InventoryApp\Reports\*.asp where the process name is w3wp.exe and the parent process is svchost.exe.

• Scheduled Backup Script Execution

  • Scenario: A scheduled Task (Task Scheduler) named “Daily Web Archive” runs every morning at 02:00 AM. This script utilizes a legacy PowerShell wrapper that invokes an old ASP utility (aspfile2.asp) to compress and tag web logs before archiving them to the backup server.
  • Filter/Exclusion: Create an exclusion rule for process powershell.exe (or specific scheduled task ID) when it executes within the directory C:\Scripts\Backup\LegacyTools\, specifically targeting files ending in .asp.

• Third-Party CRM Plugin Update

  • Scenario: The organization uses a legacy Customer Relationship Management (CRM) plugin that periodically updates its configuration. During these updates, the plugin’s installer writes a temporary aspfile2.asp file to validate database connectivity before applying changes. This is a standard part of the deployment pipeline managed by the DevOps team.
  • Filter/Exclusion: Exclude alerts where the process name matches known CRM installer executables (e.g., `CrmUpdate.exe