Web Shell - file Ajan.asp

Hunt Hypothesis

This detection identifies adversaries establishing a persistent web shell named “Ajan.asp” to execute commands and maintain access within a compromised web server environment. Proactive hunting for this specific artifact in Azure Sentinel is critical because web shells often serve as an initial foothold for lateral movement and data exfiltration, requiring immediate investigation before the adversary can expand their presence.

YARA Rule

rule webshell_asp_Ajan {
	meta:
		description = "Web Shell - file Ajan.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "b6f468252407efc2318639da22b08af0"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s3 = "entrika.write \"BinaryStream.SaveToFile \"\"c:\\downloaded.zip\"\", adSaveCreate"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file Ajan.asp detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scheduled Backup or Migration Scripts

  • Scenario: The organization utilizes a legacy backup solution (e.g., Veeam or Commvault) that periodically copies the Ajan.asp file to a staging area or performs integrity checks by reading/writing to this specific file path during off-hours. This activity mimics web shell creation/modification behavior.
  • Filter/Exclusion: Create an exclusion for source IP addresses belonging to the backup server pool (e.g., 10.20.30.x) and restrict the rule trigger window to business hours only (08:00–18:00), or add a condition where the file modification time matches known backup job timestamps.

• Automated CI/CD Deployment Pipelines

  • Scenario: A DevOps team uses Azure DevOps or Jenkins to deploy updates to the IIS web server. The pipeline includes a step that deploys Ajan.asp as part of a standard module update, triggering the rule every time a release is pushed to production.
  • Filter/Exclusion: Implement an exclusion based on the “Process Name” or “User Account.” Filter out events where the modifying user account matches the service identity used by the CI/CD agent (e.g., svc-deploy-agent or SYSTEM) and the process name is msbuild.exe, dotnet.exe, or powershell.exe.

• Third-Party Monitoring Agent Activity

  • Scenario: An enterprise monitoring tool like SolarWinds Site24x7 or Datadog actively probes web endpoints to verify availability. These agents may download, parse