Web Shell - file dabao.asp

Hunt Hypothesis

This detection rule identifies the deployment of a suspicious web shell named dabao.asp, which adversaries often use to establish persistent access and execute arbitrary commands on compromised web servers. SOC teams should proactively hunt for this indicator in Azure Sentinel because web shells serve as a critical foothold for post-exploitation activities, enabling attackers to move laterally, exfiltrate data, or maintain long-term stealth within the environment.

YARA Rule

rule webshell_asp_dabao {
	meta:
		description = "Web Shell - file dabao.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "3919b959e3fa7e86d52c2b0a91588d5d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s2 = " Echo \"<input type=button name=Submit onclick=\"\"document.location =&#039;\" &"
		$s8 = " Echo \"document.Frm_Pack.FileName.value=\"\"\"\"+year+\"\"-\"\"+(month+1)+\"\"-"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file dabao.asp detection rule, including tailored filters and exclusions:

• Scenario: Scheduled Backup or Maintenance Script Execution

  • Context: An automated maintenance job (e.g., a nightly backup script) temporarily creates dabao.asp in the web root directory to process log aggregation before deleting it. This is common in legacy IIS environments using VBScript-based automation.
  • Filter/Exclusion: Exclude files where the parent process name matches known maintenance tools (e.g., TaskScheduler.exe, msbuild.exe) and the file age is less than 24 hours, provided the file size remains under a specific threshold (e.g., <50KB).
  • Logic: IF ParentProcess IN ('TaskScheduler.exe', 'msbuild.exe') AND FileAge < 24h AND Size < 50KB THEN Exclude.

• Scenario: Deployment via CI/CD Pipeline

  • Context: During a routine application release, the DevOps team deploys dabao.asp as part of a standard module update using Azure DevOps or Jenkins. The file is created by the deployment agent and remains static after the pipeline completes.
  • Filter/Exclusion: Whitelist the specific user account used for deployments (e.g., DOMAIN\DevOpsAgent) and exclude events where the source IP belongs to the internal CI/CD server subnet.
  • Logic: IF UserAccount == 'DOMAIN\DevOpsAgent' AND SourceIP IN ('10.20.30.0/24') THEN Exclude.

• Scenario: Third-Party Analytics or Reporting Tool Installation

  • Context: A legitimate third-party analytics vendor (e.g., Splunk Universal Forwarder, Tableau Server connector)