Web Shell - file aspydrv.asp

Hunt Hypothesis

This detection identifies adversaries deploying a web shell named aspYdrv.asp to establish persistent access and execute commands on compromised web servers within the Azure environment. Proactively hunting for this specific artifact is critical because web shells often serve as an initial foothold for lateral movement and data exfiltration, allowing attackers to maintain stealthy control over sensitive infrastructure before broader detection occurs.

YARA Rule

rule webshell_ASP_aspydrv {
	meta:
		description = "Web Shell - file aspydrv.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "de0a58f7d1e200d0b2c801a94ebce330"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s3 = "<%=thingy.DriveLetter%> </td><td><tt> <%=thingy.DriveType%> </td><td><tt> <%=thi"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file aspydrv.asp detection rule, along with suggested filters and exclusions:

• Scenario: Automated Backup or Migration Scripts

  • Context: Enterprise backup solutions (e.g., Veeam, Rubrik) or migration tools often deploy temporary ASP scripts to the IIS root directory (/asp) to facilitate data transfer or inventory checks. These tools may create a file named asydrv.asp or similar variants that mimic the structure of known web shells during the execution window.
  • Suggested Filter: Exclude files created by specific service accounts (e.g., DOMAIN\BackupSvc, DOMAIN\MigrationAgent) within the IIS application pool identity context. Additionally, filter based on file age; if the file is older than 24 hours and has not been modified recently, suppress the alert as it likely belongs to a completed maintenance window.

• Scenario: Scheduled Health Monitoring Jobs

  • Context: Internal IT operations teams often deploy scheduled PowerShell jobs or System Center Operations Manager (SCOM) probes that generate temporary ASP files to monitor server health or test connectivity. These scripts are frequently named generically, such as aspdrv.asp (or similar), and reside in standard web directories like C:\inetpub\wwwroot.
  • Suggested Filter: Create an exclusion for file paths located under specific subdirectories known for monitoring artifacts (e.g., \HealthChecks, \Monitoring). Furthermore, filter by process name; if the creating process is svchost.exe running a scheduled task or w3wp.exe with a known “MonitorAppPool” identity, mark as benign.

• Scenario: Third-Party Application Deployment

  • Context: During the installation or patching of third-party enterprise applications (e.g., **SAP