Web Shell - file cmd.asp

Hunt Hypothesis

This detection identifies adversaries deploying a cmd.asp web shell to establish a persistent command-and-control channel for executing remote commands on compromised web servers. Proactive hunting is essential in Azure Sentinel because web shells often evade standard signature-based defenses by blending with legitimate traffic, allowing attackers to maintain stealthy access and pivot deeper into the environment before detection.

YARA Rule

rule webshell_ASP_cmd {
	meta:
		description = "Web Shell - file cmd.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "97af88b478422067f23b001dd06d56a9"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file cmd.asp detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Backup or Migration Scripts

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) or migration tools often deploy temporary .asp scripts to the IIS root directory (C:\inetpub\wwwroot) to execute file synchronization commands via cmd.exe. These scripts are frequently named generically like cmd.asp during the initial deployment phase.
  • Filter/Exclusion: Create an exclusion rule that ignores alerts where the file path matches known backup directories (e.g., C:\inetpub\wwwroot\backup\_temp\) AND the process creating the file belongs to a trusted service account (e.g., NT SERVICE\VeeamTransport).

• Scenario: Scheduled Health Check Jobs

  • Context: System administrators often configure Windows Task Scheduler jobs to run nightly health checks. These jobs may invoke a custom .asp page named cmd.asp located in the Scripts subfolder of the web application, which executes diagnostic commands against the database or server resources.
  • Filter/Exclusion: Exclude files where the creation timestamp falls within the defined maintenance window (e.g., 02:00–04:00 daily) and the file resides in a dedicated administrative folder path such as C:\inetpub\wwwroot\admin\_health\cmd.asp.

• Scenario: Deployment of Standard Library Components

  • Context: During routine application updates via CI/CD pipelines (e.g., Azure DevOps, Jenkins), deployment agents push standard utility libraries to the web server. A common practice in legacy ASP.NET environments is to include a generic command handler named cmd.asp as part of the core framework distribution