← Back to SOC feed Coverage →

Shell Creator used by attackers in Operation Cleaver to create ASPX web shells

yara HIGH Yara-Rules
backdoorcommunitywebshell
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-31T23:00:00Z · Confidence: medium

Hunt Hypothesis

Attackers are using Shell Creator to deploy ASPX web shells as part of Operation Cleaver, indicating a targeted persistence mechanism. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate advanced persistent threats before they exfiltrate data or execute further malicious actions.

YARA Rule

rule OPCLEAVER_ShellCreator2
{

    meta:
        description = "Shell Creator used by attackers in Operation Cleaver to create ASPX web shells"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "ShellCreator2.Properties"
        $s2 = "set_IV"

    condition:
        all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_OPCleaver.yar