Detects a pattern which is often related to web shell activity

Hunt Hypothesis

This detection rule identifies suspicious file creation and execution patterns characteristic of web shells, which adversaries frequently deploy to establish persistent access points on compromised web servers for command-and-control or lateral movement. Proactively hunting for this behavior in Azure Sentinel is critical because web shells often operate within trusted application boundaries, allowing attackers to evade standard perimeter defenses while maintaining a low profile for extended periods.

YARA Rule

rule SUSP_WEBSHELL_Cmd_Indicator_Apr25 {
   meta:
      description = "Detects a pattern which is often related to web shell activity"
      reference = "https://regex101.com/r/N6oZ2h/2"
      author = "Florian Roth"
      date = "2025-04-25"
      modified = "2025-05-07"
      score = 60
      id = "eeeebfbc-9418-5ff4-b45f-8d96a9e7e4a8"
   strings:
      $xr01 = /\.(asp|aspx|jsp|php)\?cmd=[a-z0-9%+\-\/\.]{3,20} HTTP\/1\.[01]["']? 200/
   condition:
      1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://regex101.com/r/N6oZ2h/2
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Web Shell Activity” detection rule, including suggested filters and exclusions:

• Automated Backup Scripts via PowerShell/Python

  • Scenario: Enterprise backup solutions (e.g., Veeam, Commvault) or custom maintenance scripts often execute long-running PowerShell (powershell.exe) or Python (python.exe) processes from the C:\Windows\System32 directory. These scripts frequently invoke HTTP requests to internal management APIs or upload logs to a central repository, mimicking the file creation and network communication patterns of a web shell.
  • Filter/Exclusion: Exclude processes where the executable path matches known backup service binaries (e.g., C:\Program Files\Commvault\CvService\cv.exe invoking powershell.exe) or add an exclusion for process command lines containing specific keywords like “Backup,” “Sync,” or “Report” that originate from trusted Service Accounts.

• Scheduled CI/CD Pipeline Deployments

  • Scenario: Continuous Integration tools (e.g., Jenkins, GitLab Runner, Azure DevOps Agents) regularly deploy artifacts to web servers during maintenance windows. These agents often create temporary configuration files or scripts in the IIS wwwroot directory and execute them immediately via the web server process (w3wp.exe) to validate deployments before finalizing them.
  • Filter/Exclusion: Implement a filter that excludes activity occurring within defined maintenance windows (e.g., 02:00–04:00 UTC) or exclude events where the parent process is identified as a known CI/CD agent service (e.g., Jenkins.exe, AzureDevOpsAgent.exe) running under a dedicated “Build-Service” account.

• Third-Party Monitoring and APM Agents

  • Scenario: Application Performance Monitoring tools like Dynatrace, New