Web Shell - file ajn.asp

Hunt Hypothesis

This detection rule identifies the creation of a suspicious web shell named ajn.asp, which adversaries often deploy to establish persistent access and execute commands on compromised web servers for post-exploitation activities. The SOC team should proactively hunt for this artifact in Azure Sentinel because web shells are frequently used as initial footholds that can lead to lateral movement, data exfiltration, or ransomware deployment if left undetected.

YARA Rule

rule webshell_asp_ajn {
	meta:
		description = "Web Shell - file ajn.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "aaafafc5d286f0bff827a931f6378d04"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "seal.write \"Set WshShell = CreateObject(\"\"WScript.Shell\"\")\" & vbcrlf" fullword
		$s6 = "seal.write \"BinaryStream.SaveToFile \"\"c:\\downloaded.zip\"\", adSaveCreateOve"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file ajn.asp detection rule, including recommended filters and exclusions:

• Scenario: Automated Backup Script Execution

  • Context: The enterprise utilizes a custom backup utility (e.g., Veeam Agent or a PowerShell wrapper) that periodically generates temporary ASP files in the web root directory to log backup status. One of these scripts is named ajn.asp by convention, located in C:\inetpub\wwwroot\logs\.
  • Filter/Exclusion: Exclude file creation events where the source path matches C:\inetpub\wwwroot\logs\ and the process name is vbrsvc.exe (Veeam) or powershell.exe running under a specific service account (e.g., DOMAIN\BackupSvc).

• Scenario: Legacy Reporting Dashboard Deployment

  • Context: A quarterly financial reporting tool deployed by the Finance department uses a legacy ASP.NET framework. The deployment package includes a static helper file named ajn.asp used for rendering charts, which is updated via a scheduled CI/CD pipeline (e.g., Azure DevOps or Jenkins) every Monday at 02:00 AM.
  • Filter/Exclusion: Create an exclusion rule based on the deployment window. Suppress alerts for ajn.asp modifications occurring between 01:30 and 02:30 UTC on Mondays, provided the user context is the CI service account (e.g., DOMAIN\CI-Build-User).

• Scenario: Third-Party Analytics Integration

  • Context: The organization has integrated a third-party analytics platform (e.g., Google Tag Manager or Adobe Experience Cloud) that injects tracking scripts into the web server. This integration creates a persistent ajn.asp