← Back to SOC feed Coverage →

ASPXSpy detection. It might be used by other fraudsters

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-26T23:00:01Z · Confidence: medium

Hunt Hypothesis

The hypothesis is that the detection of ASPXSpy indicates potential adversary use of a known malicious framework, which could be leveraged by other threat actors for similar malicious purposes. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential compromise or data exfiltration activities early.

YARA Rule

rule IronTiger_ASPXSpy
{
    
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "ASPXSpy detection. It might be used by other fraudsters"
        reference = "http://goo.gl/T5fSJC"
   
    strings:
        $str1 = "ASPXSpy" nocase wide ascii
        $str2 = "IIS Spy" nocase wide ascii
        $str3 = "protected void DGCoW(object sender,EventArgs e)" nocase wide ascii
    
    condition:
        any of ($str*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_Irontiger.yar