Web Shell - file up.asp

Hunt Hypothesis

This detection identifies the creation of a suspicious ASP web shell named “up.asp,” which adversaries often deploy to establish persistent command-and-control channels or execute arbitrary commands on compromised web servers. Proactively hunting for this specific artifact in Azure Sentinel is critical because web shells serve as a primary foothold for attackers, enabling them to maintain stealthy access and pivot deeper into the environment before traditional alerts trigger.

YARA Rule

rule webshell_asp_up {
	meta:
		description = "Web Shell - file up.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "f775e721cfe85019fe41c34f47c0d67c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "Pos = InstrB(BoundaryPos,RequestBin,getByteString(\"Content-Dispositio"
		$s1 = "ContentType = getString(MidB(RequestBin,PosBeg,PosEnd-PosBeg))" fullword
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for “Web Shell - file up.asp” Rule

• Scenario 1: Automated Backup and Archiving by System Administrator

  • Context: A system administrator uses a script to archive old logs or temporary data into the web root directory. The script creates a temporary upload file named up.asp in the \wwwroot\temp folder before processing and deleting it.
  • Suggested Filter/Exclusion: Exclude files created by specific service accounts (e.g., DOMAIN\AdminBackup) within known non-critical directories like \wwwroot\temp or \wwwroot\archive. Additionally, filter out events where the file size exceeds a threshold typical for web shells (e.g., >50KB) if the backup script generates larger files.

• Scenario 2: Scheduled Deployment via CI/CD Pipeline

  • Context: A DevOps pipeline using tools like Azure DevOps, Jenkins, or GitHub Actions deploys a standard utility module named up.asp to the production IIS server during nightly maintenance windows. This file is part of a legitimate application update package, not an injected shell.
  • Suggested Filter/Exclusion: Create an exclusion based on the source IP address of the CI/CD runner (e.g., 10.20.30.5) and restrict alerts to occur only outside of defined maintenance windows (e.g., 02:00–04:00). Alternatively, whitelist the specific file hash if the deployment package is immutable.

• Scenario 3: Third-Party CRM or ERP Integration Sync

  • Context: An enterprise resource planning system (such as SAP, Microsoft Dynamics 365, or Salesforce) performs a scheduled synchronization job that writes an intermediate processing file named up.asp to the