This detection identifies generic ASP webshells actively querying the Windows Registry to exfiltrate sensitive configuration data such as stored credentials, license keys, and database connection strings. Proactive hunting for this behavior in Azure Sentinel is critical because registry enumeration often serves as a stealthy initial reconnaissance step that precedes deeper privilege escalation or lateral movement within compromised environments.
rule WEBSHELL_ASP_Generic_Registry_Reader
{
meta:
description = "Generic ASP webshell which reads the registry (might look for passwords, license keys, database settings, general recon, ..."
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Arnim Rupp (https://github.com/ruppde)"
reference = "Internal Research"
date = "2021/03/14"
modified = "2023-07-05"
score = 50
hash = "4d53416398a89aef3a39f63338a7c1bf2d3fcda4"
hash = "f85cf490d7eb4484b415bea08b7e24742704bdda"
hash = "898ebfa1757dcbbecb2afcdab1560d72ae6940de"
id = "02d6f95f-1801-5fb0-8ab8-92176cf2fdd7"
strings:
/* $asp_reg1 = "Registry" fullword wide ascii */ /* too many matches issues */
$asp_reg2 = "LocalMachine" fullword wide ascii
$asp_reg3 = "ClassesRoot" fullword wide ascii
$asp_reg4 = "CurrentUser" fullword wide ascii
$asp_reg5 = "Users" fullword wide ascii
$asp_reg6 = "CurrentConfig" fullword wide ascii
$asp_reg7 = "Microsoft.Win32" fullword wide ascii
$asp_reg8 = "OpenSubKey" fullword wide ascii
$sus1 = "shell" fullword nocase wide ascii
$sus2 = "cmd.exe" fullword wide ascii
$sus3 = "<form " wide ascii
$sus4 = "<table " wide ascii
$sus5 = "System.Security.SecurityException" wide ascii
$fp1 = "Avira Operations GmbH" wide
//strings from private rule capa_asp
$tagasp_short1 = /<%[^"]/ wide ascii
// also looking for %> to reduce fp (yeah, short atom but seldom since special chars)
$tagasp_short2 = "%>" wide ascii
// classids for scripting host etc
$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
$tagasp_long10 = "<%@ " wide ascii
// <% eval
$tagasp_long11 = /<% \w/ nocase wide ascii
$tagasp_long12 = "<%ex" nocase wide ascii
$tagasp_long13 = "<%ev" nocase wide ascii
// <%@ LANGUAGE = VBScript.encode%>
// <%@ Language = "JScript" %>
// <%@ WebHandler Language="C#" class="Handler" %>
// <%@ WebService Language="C#" Class="Service" %>
// <%@Page Language="Jscript"%>
// <%@ Page Language = Jscript %>
// <%@PAGE LANGUAGE=JSCRIPT%>
// <%@ Page Language="Jscript" validateRequest="false" %>
// <%@ Page Language = Jscript %>
// <%@ Page Language="C#" %>
// <%@ Page Language="VB" ContentType="text/html" validaterequest="false" AspCompat="true" Debug="true" %>
// <script runat="server" language="JScript">
// <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
// <SCRIPT RUNAT=SERVER LANGUAGE=JSCRIPT>
// <msxsl:script language="JScript" ...
$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
// avoid hitting php
$php1 = "<?php"
$php2 = "<?="
// avoid hitting jsp
$jsp1 = "=\"java." wide ascii
$jsp2 = "=\"javax." wide ascii
$jsp3 = "java.lang." wide ascii
$jsp4 = "public" fullword wide ascii
$jsp5 = "throws" fullword wide ascii
$jsp6 = "getValue" fullword wide ascii
$jsp7 = "getBytes" fullword wide ascii
$perl1 = "PerlScript" fullword
//strings from private rule capa_asp_input
// Request.BinaryRead
// Request.Form
$asp_input1 = "request" fullword nocase wide ascii
$asp_input2 = "Page_Load" fullword nocase wide ascii
// base64 of Request.Form(
$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
$asp_xml_method1 = "GET" fullword wide ascii
$asp_xml_method2 = "POST" fullword wide ascii
$asp_xml_method3 = "HEAD" fullword wide ascii
// dynamic form
$asp_form1 = "<form " wide ascii
$asp_form2 = "<Form " wide ascii
$asp_form3 = "<FORM " wide ascii
$asp_asp = "<asp:" wide ascii
$asp_text1 = ".text" wide ascii
$asp_text2 = ".Text" wide ascii
condition:
(
(
any of ( $tagasp_long* ) or
// TODO : yara_push_private_rules.py doesn't do private rules in private rules yet
any of ( $tagasp_classid* ) or
(
$tagasp_short1 and
$tagasp_short2 in ( filesize-100..filesize )
) or (
$tagasp_short2 and (
$tagasp_short1 in ( 0..1000 ) or
$tagasp_short1 in ( filesize-1000..filesize )
)
)
) and not (
(
any of ( $perl* ) or
$php1 at 0 or
$php2 at 0
) or (
( #jsp1 + #jsp2 + #jsp3 ) > 0 and ( #jsp4 + #jsp5 + #jsp6 + #jsp7 ) > 0
)
)
)
and all of ( $asp_reg* ) and any of ( $sus* ) and not any of ( $fp* ) and
( filesize < 10KB or
( filesize < 150KB and (
any of ( $asp_input* ) or
(
$asp_xml_http and
any of ( $asp_xml_method* )
) or
(
any of ( $asp_form* ) and
any of ( $asp_text* ) and
$asp_asp
)
)
) )
}This YARA rule can be deployed in the following contexts:
This rule contains 51 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the “Generic ASP webshell which reads the registry” detection rule, including suggested filters or exclusions:
Scenario: Automated License Validation by Microsoft Office Deployment Tool
OfficeDeploymentTool.exe (or similar MS Office setup scripts) often executes an ASP-based script during scheduled maintenance windows to read registry keys under HKLM\SOFTWARE\Microsoft\Office to verify license status, feature configurations, and activation keys before applying updates.msiexec.exe or setup.exe running from a known enterprise installation path (e.g., C:\Program Files\Microsoft Office Setup\) and the target registry hive is restricted to HKLM\SOFTWARE\Microsoft.Scenario: Database Connection String Retrieval by Custom ERP Application
MyERPService.exe) periodically reads the registry key HKCU\Software\MyCompany\DBConfig to dynamically load database connection strings and encryption settings at startup or during runtime configuration refreshes.MyERPService.exe, SAPNetWeaver.exe) where the registry path contains known application identifiers (like “MyCompany” or “SAP”) and the process is running under a dedicated service account (e.g., NT SERVICE\MyERP).Scenario: Scheduled Antivirus Policy Sync via Group Policy
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender to ensure compliance with enterprise