Web Shell - file tool.asp

Hunt Hypothesis

This detection targets adversaries who deploy a malicious web shell named tool.asp to establish persistent access and execute commands on compromised web servers. Proactively hunting for this specific artifact in Azure Sentinel is critical because web shells often serve as an initial foothold for lateral movement and data exfiltration, requiring immediate investigation before the adversary can expand their presence within the environment.

YARA Rule

rule webshell_ASP_tool {
	meta:
		description = "Web Shell - file tool.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "4ab68d38527d5834e9c1ff64407b34fb"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "Response.Write \"<FORM action=\"\"\" & Request.ServerVariables(\"URL\") & \"\"\""
		$s3 = "Response.Write \"<tr><td><font face='arial' size='2'><b>&lt;DIR&gt; <a href='\" "
		$s9 = "Response.Write \"<font face='arial' size='1'><a href=\"\"#\"\" onclick=\"\"javas"
	condition:
		2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file tool.asp detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup or Migration Scripts

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) or migration tools often deploy generic utility scripts named tool.asp to temporary directories during nightly maintenance windows. These scripts may perform file I/O operations that mimic web shell behavior.
  • Filter/Exclusion: Exclude files created by specific service accounts (e.g., DOMAIN\BackupSvc, SYSTEM) within known backup directories (e.g., C:\ProgramData\Veeam\Tools or D:\Migrations). Additionally, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: CMS Plugin Updates and Deployments

  • Context: Content Management Systems like SharePoint or custom ASP.NET portals frequently use a standard tool.asp file as part of their deployment pipeline. When an administrator deploys a new plugin or patches the IIS application, the deployment engine (e.g., Octopus Deploy, Azure DevOps) may instantiate this file to verify connectivity or run post-deployment checks.
  • Filter/Exclusion: Create an exclusion for files located in standard CMS installation paths (e.g., C:\inetpub\wwwroot\SharePoint\_layouts or D:\WebApps\Portal). Filter based on the parent process being a known deployment agent, such as msbuild.exe, wcmproc.exe, or Octopus.Client.exe.

• Scenario: Scheduled Health Check and Monitoring Agents

  • Context: Infrastructure monitoring tools (e.g., SolarWinds, Datadog Agent, Nagios) often utilize a lightweight ASP script named `tool.asp