Web Shell - file shell.asp

Hunt Hypothesis

This detection identifies adversaries establishing a persistent web shell named shell.asp to execute arbitrary commands and maintain access within Azure-hosted web applications. Proactive hunting for this artifact is critical because web shells often serve as an initial foothold for post-exploitation activities, allowing attackers to pivot laterally or exfiltrate sensitive data before triggering broader alerts.

YARA Rule

rule webshell_asp_shell {
	meta:
		description = "Web Shell - file shell.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "e63f5a96570e1faf4c7b8ca6df750237"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s7 = "<input type=\"submit\" name=\"Send\" value=\"GO!\">" fullword
		$s8 = "<TEXTAREA NAME=\"1988\" ROWS=\"18\" COLS=\"78\"></TEXTAREA>" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file shell.asp detection rule, along with suggested filters or exclusions:

• Scenario: Legacy Content Management System (CMS) Maintenance

  • Context: An enterprise using an older version of SharePoint or a custom .NET-based CMS often deploys shell.asp as a standard entry point for administrative modules. During routine maintenance windows, the system administrator may upload this file to update site configurations without it being malicious.
  • Suggested Filter: Exclude files where the parent directory is known to be part of the official application root (e.g., C:\Program Files\SharePoint\ or D:\WebApps\CMS\Admin) and the file hash matches a baseline registry of approved CMS artifacts.

• Scenario: Automated Backup and Reporting Scripts

  • Context: Internal IT operations teams often utilize scheduled tasks via Windows Task Scheduler to run nightly reporting scripts. These scripts, written in ASP Classic, may dynamically generate or copy shell.asp into a temporary staging folder (e.g., C:\Temp\Reports) before archiving logs for the ServiceNow ticketing system.
  • Suggested Filter: Create an exclusion based on the source process name being svchost.exe (running under the SYSTEM account) or specific service accounts like BackupAgent, and limit the scope to files created within the C:\Temp\ directory during defined maintenance hours (e.g., 02:00–04:00).

• Scenario: Third-Party Vendor Integration Deployment

  • Context: External vendors, such as those managing Salesforce integrations or SAP interfaces, frequently deploy custom ASP components to handle data synchronization. A vendor might push a shell.asp file to the IIS web root