Web Shell - file 1d.asp

Hunt Hypothesis

This detection identifies the creation of a suspicious web shell named “1d.asp,” which adversaries often deploy to establish a persistent foothold for remote command execution and lateral movement within web applications. Proactive hunting is essential in Azure Sentinel because this specific file name frequently indicates an early-stage compromise that may bypass standard signature-based alerts, requiring manual validation to prevent potential data exfiltration or system takeover.

YARA Rule

rule webshell_asp_1d {
	meta:
		description = "Web Shell - file 1d.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "fad7504ca8a55d4453e552621f81563c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "+9JkskOfKhUxZJPL~\\(mD^W~[,{@#@&EO"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Web Shell - file 1d.asp detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup or Migration Scripts

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) or database migration tools often generate temporary staging files with generic naming conventions during nightly jobs. A script might create a file named 1d.asp as part of a sequential upload process to the IIS web root (C:\inetpub\wwwroot) before renaming it immediately after processing.
  • Filter/Exclusion: Exclude events where the source user is a known service account (e.g., DOMAIN\VeeamSvc, DOMAIN\BackupAdmin) and the file creation timestamp falls within the defined maintenance window (e.g., 02:00–04:00 local time). Additionally, filter out files that are deleted or renamed within 60 seconds of creation.

• Scenario: Development Environment Deployment Pipelines

  • Context: In a DevOps environment using CI/CD tools like Jenkins, Azure DevOps, or GitHub Actions, the deployment agent frequently pushes temporary test artifacts to the staging web server. The pipeline might use 1d.asp as a standard placeholder filename for initial connectivity checks or load testing scripts before deploying the final application version.
  • Filter/Exclusion: Create an exclusion list based on specific IP ranges associated with CI/CD agents (e.g., 10.20.5.0/24). Furthermore, exclude files created by processes running under the context of the deployment service (e.g., Jenkins.exe, AzureDevOpsAgent) where the file path contains a temporary directory structure like \temp\ or \staging\.

• Scenario: Scheduled Diagnostic and Health Checks *