Disclosed hacktool set (old stuff) - file cmd.jsp

Hunt Hypothesis

This rule detects adversaries deploying legacy command-and-control mechanisms via a cmd.jsp web shell to establish persistent access and execute remote commands within the environment. The SOC team should proactively hunt for this artifact in Azure Sentinel because outdated JSP-based tools often contain known vulnerabilities that attackers leverage to maintain stealthy footholds and facilitate lateral movement across cloud resources.

YARA Rule

rule sig_238_cmd_2 {
	meta:
		description = "Disclosed hacktool set (old stuff) - file cmd.jsp"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "be4073188879dacc6665b6532b03db9f87cfc2bb"
	strings:
		$s0 = "Process child = Runtime.getRuntime().exec(" ascii
		$s1 = "InputStream in = child.getInputStream();" fullword ascii
		$s2 = "String cmd = request.getParameter(\"" ascii
		$s3 = "while ((c = in.read()) != -1) {" fullword ascii
		$s4 = "<%@ page import=\"java.io.*\" %>" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Disclosed hacktool set (old stuff) - file cmd.jsp” detection rule, including suggested filters and exclusions:

• Legacy Application Deployment via Jenkins Pipeline

  • Scenario: The DevOps team utilizes a legacy Jenkins pipeline to deploy updates to an older Java-based internal portal. During the deployment phase, the build agent (running as jenkins user) extracts a WAR file which includes a standard cmd.jsp utility used for command-line diagnostics within the application container.
  • Filter/Exclusion: Exclude processes where the parent process is java.exe or mvn.exe and the source path matches the deployment directory (e.g., C:\Jenkins\workspace\app-deploy\).

• Scheduled Maintenance Job for Tomcat Health Checks

  • Scenario: A nightly scheduled task (Task Scheduler) runs a custom PowerShell script to verify the health of the Apache Tomcat cluster. This script invokes a specific JSP endpoint (cmd.jsp) located in the webapps/ROOT directory to trigger internal garbage collection and log rotation reports.
  • Filter/Exclusion: Create an exclusion for files accessed by the System or Network Service account where the file path contains \tomcat\webapps\ROOT\WEB-INF\jsp\cmd.jsp.

• Database Backup Utility Execution

  • Scenario: The enterprise uses a legacy backup tool (e.g., Veeam or Commvault) that integrates with Java-based database connectors. During the “pre-backup” phase, the connector generates a temporary cmd.jsp file to log connection parameters and execute pre-flight checks before initiating the full backup stream.
  • Filter/Exclusion: Filter out events where the process name is vbr.exe, commvault_agent.exe, or similar known backup agents