Web Shell - file cmdasp.asp

Hunt Hypothesis

This detection identifies the creation of a cmdasp.asp web shell file, indicating an adversary has established a persistent foothold to execute commands and maintain access on a compromised web server. Proactively hunting for this artifact in Azure Sentinel is critical because web shells often serve as the initial entry point for lateral movement and data exfiltration attacks that may evade standard signature-based defenses.

YARA Rule

rule webshell_asp_cmdasp {
	meta:
		description = "Web Shell - file cmdasp.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "57b51418a799d2d016be546f399c2e9b"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
		$s7 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file cmdasp.asp detection rule, along with recommended filters or exclusions:

• Scenario: Automated Deployment via CI/CD Pipeline

  • Context: A DevOps team uses Azure DevOps or GitHub Actions to deploy a new version of an ASP.NET application. The deployment script explicitly copies a standard utility file named cmdasp.asp (used for internal diagnostics) into the IIS root directory (C:\inetpub\wwwroot\Apps\Internal).
  • Filter/Exclusion: Exclude files created by the specific service account used by the CI/CD agent (e.g., NT SERVICE\AzureDevOpsAgent) and restrict the detection to paths outside of known deployment directories like \Apps\ or \DeployedContent\.

• Scenario: Scheduled Maintenance Script Execution

  • Context: The IT Operations team runs a nightly maintenance job using Windows Task Scheduler that invokes cmdasp.asp to generate server health reports. This script is triggered by the account DOMAIN\AdminMaintenance at 02:00 AM every day, creating or modifying the file in the \Scripts\Maintenance\ folder.
  • Filter/Exclusion: Create a time-based exclusion window (e.g., 01:30–03:00 daily) for events originating from the DOMAIN\AdminMaintenance account within the specific directory path \Scripts\Maintenance\.

• Scenario: Legacy Application Migration

  • Context: During a migration project, the team moves an older legacy module to a new server using Robocopy or PowerShell. The source application relies on cmdasp.asp as its primary command interface. The file is copied by the DOMAIN\BackupService account during the initial sync phase.
  • **Filter