Web Shell - file 1.asp

Hunt Hypothesis

This detection rule identifies the creation of a suspicious web shell named “1.asp,” which adversaries often deploy to establish persistent access and execute commands on compromised web servers. A proactive hunt is essential in Azure Sentinel because generic filenames like “1.asp” frequently evade standard signature-based alerts, allowing attackers to maintain stealthy command-and-control channels that could lead to lateral movement or data exfiltration if left undetected.

YARA Rule

rule webshell_asp_1 {
	meta:
		description = "Web Shell - file 1.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "8991148adf5de3b8322ec5d78cb01bdb"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s4 = "!22222222222222222222222222222222222222222222222222" fullword
		$s8 = "<%eval request(\"pass\")%>" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file 1.asp detection rule, including tailored filters and exclusions:

• Scenario: Automated Backup Script Execution

  • Context: The enterprise backup solution (e.g., Veeam Backup & Replication or Acronis Cyber Protect) runs a nightly maintenance job that temporarily creates a generic 1.asp file in the IIS root directory to log upload status or verify connectivity before archiving. This file is often named generically by the script logic rather than a specific descriptive name.
  • Filter/Exclusion: Create an exclusion based on the Process Name and Parent Process. Exclude alerts where the parent process is VeeamService.exe (or AcronisAgent.exe) and the file path resides within a dedicated backup staging folder (e.g., C:\ProgramData\Veeam\Staging\).

• Scenario: Development Environment Deployment via CI/CD

  • Context: During routine application deployments, the Azure DevOps or Jenkins pipeline executes a deployment agent that pushes standard ASP.NET templates to the staging web server. The deployment manifest often includes a default 1.asp placeholder file used for initial health checks before the full application suite is loaded.
  • Filter/Exclusion: Implement a filter based on Source IP Address. Exclude events originating from the known CI/CD controller IPs (e.g., 10.x.x.50 to 10.x.x.60) or exclude files created by the specific service account used for deployments, such as NT SERVICE\IISADMIN or a dedicated DeployBot user.

• Scenario: Scheduled Health Check Monitoring

  • Context: The internal monitoring tool (e.g., SolarWinds NPM or **P