Web Shell - file Rader.asp

Hunt Hypothesis

This detection identifies adversaries establishing a persistent web shell named “Rader.asp” to execute commands and maintain access within the Azure environment. Proactive hunting for this specific artifact is critical because web shells serve as a common entry point for lateral movement and data exfiltration, often remaining undetected by standard signature-based monitoring until significant compromise occurs.

YARA Rule

rule webshell_asp_Rader {
	meta:
		description = "Web Shell - file Rader.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "ad1a362e0a24c4475335e3e891a01731"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "FONT-WEIGHT: bold; FONT-SIZE: 10px; BACKGROUND: none transparent scroll repeat 0"
		$s3 = "m\" target=inf onClick=\"window.open('?action=help','inf','width=450,height=400 "
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Web Shell - file Rader.asp detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup Utility Deployment

  • Context: The enterprise uses Veeam Backup & Replication or Acronis Cyber Protect to perform nightly backups of web content. During the backup process, these tools often stage temporary files in the IIS wwwroot directory before archiving them. A file named Rader.asp (likely a typo for “Reader” or a specific module name) is frequently created as a staging artifact by the backup agent service running under the SYSTEM account.
  • Filter/Exclusion: Exclude events where the ProcessName matches VeeamService.exe, AcronisAgent.exe, or the user principal is NT AUTHORITY\SYSTEM. Additionally, filter out files created in directories named _backup_staging or temp_upload.

• Scenario: Scheduled Content Migration Job

  • Context: A weekly scheduled task managed by Microsoft System Center Configuration Manager (SCCM) or a custom PowerShell script runs every Monday at 02:00 AM to migrate legacy content from an internal CMS. This job deploys a specific utility file named Rader.asp within the /admin/tools/ subdirectory to assist in parsing XML data during migration.
  • Filter/Exclusion: Create an exclusion based on the FilePath containing \admin\tools\ and the ProcessName being powershell.exe. Further refine by excluding events occurring between 01:30 AM and 04:00 AM on weekdays, or specifically targeting the parent process ID (PPID) of the SCCM agent service.

• Scenario: Third-Party Analytics Agent Installation

  • Context: