Web Shell - file list.asp

Hunt Hypothesis

This detection identifies adversaries deploying a malicious web shell named “list.asp” to establish a persistent foothold and execute commands within the organization’s web infrastructure. Proactively hunting for this artifact in Azure Sentinel is critical because web shells often serve as an initial entry point for lateral movement and data exfiltration, allowing attackers to operate stealthily before triggering broader security alerts.

YARA Rule

rule webshell_asp_list {
	meta:
		description = "Web Shell - file list.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "1cfa493a165eb4b43e6d4cc0f2eab575"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "<INPUT TYPE=\"hidden\" NAME=\"type\" value=\"<%=tipo%>\">" fullword
		$s4 = "Response.Write(\"<h3>FILE: \" & file & \"</h3>\")" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Web Shell - file list.asp detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup or Migration Script Execution

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) or migration tools often deploy temporary .asp scripts to inventory directory contents before archiving. A scheduled job might execute list.asp on the IIS server root to generate a pre-migration manifest of active web files.
  • Filter/Exclusion: Create an exclusion based on the Process Name and User Account. Filter out alerts where the process is vssvc.exe, commvault.cmd, or migrate_agent.exe running under a dedicated service account (e.g., DOMAIN\BackupSvc) rather than interactive user accounts.

• Scenario: Legacy Application Health Monitoring & Diagnostics

  • Context: In environments maintaining legacy ASP.NET applications, internal monitoring tools (such as SolarWinds or custom PowerShell scripts) periodically invoke diagnostic pages like list.asp to verify file permissions and directory structures during routine health checks. This often occurs on a specific schedule (e.g., every 15 minutes).
  • Filter/Exclusion: Implement a time-based exclusion window combined with a Source IP filter. Exclude alerts originating from the internal monitoring server’s IP address (e.g., 10.20.30.45) during defined maintenance windows (e.g., 02:00–04:00 daily) where these diagnostic scripts are known to run.

• Scenario: Development Team Deployment via CI/CD Pipeline

  • Context: During the deployment phase of a Continuous Integration/Continuous Deployment (CI/CD) pipeline using tools like Jenkins, Azure DevOps, or GitLab CI, the