Web Shell - file RemExp.asp

Hunt Hypothesis

This detection identifies adversaries deploying a malicious ASP web shell named “RemExp.asp” to establish persistent access and execute commands on exposed web servers. Proactively hunting for this artifact in Azure Sentinel is critical because web shells often serve as an initial foothold for attackers to pivot laterally, exfiltrate sensitive data, or maintain long-term persistence within the organization’s cloud infrastructure.

YARA Rule

rule webshell_ASP_RemExp {
	meta:
		description = "Web Shell - file RemExp.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Reques"
		$s1 = "Private Function ConvertBinary(ByVal SourceNumber, ByVal MaxValuePerIndex, ByVal"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file RemExp.asp detection rule, including suggested filters or exclusions:

• Scenario: Legacy Reporting Tool Deployment

  • Context: The enterprise utilizes a legacy internal reporting suite (e.g., SAP BusinessObjects or MicroStrategy) that deploys a standard RemExp.asp file to the IIS web root (C:\inetpub\wwwroot) during nightly data synchronization jobs. This file is used to render export logs and does not contain malicious logic.
  • Filter/Exclusion: Create an exclusion rule for files created by the specific service account (e.g., DOMAIN\BO_Service_Acc) within the known reporting directory path (C:\inetpub\wwwroot\Reports\*).

• Scenario: Scheduled Backup and Archiving Script

  • Context: A scheduled task running via Windows Task Scheduler executes a custom VBScript wrapper that generates temporary RemExp.asp files to archive transaction logs before moving them to the backup location. These files are created by the local system account (NT AUTHORITY\SYSTEM) and are deleted immediately after processing.
  • Filter/Exclusion: Filter out events where the process name is TaskHost.exe or svchost.exe (with specific service parameters) and the file age is less than 15 minutes, indicating a transient temporary file rather than a persistent web shell.

• Scenario: Automated Patching and Configuration Management

  • Context: The organization uses Ansible or SCCM (System Center Configuration Manager) to push configuration updates to web servers. During the deployment of a new module, the automation engine creates RemExp.asp as part of a standard template for handling remote export configurations on multiple IIS nodes simultaneously.
  • Filter/Exclusion: