Web Shell - file zehir.asp

Hunt Hypothesis

This detection identifies adversaries establishing a persistent web shell via the specific zehir.asp file to execute commands and maintain access within the Azure environment. Proactively hunting for this artifact is critical because web shells often serve as an initial foothold for attackers to pivot laterally, exfiltrate sensitive data, or escalate privileges before broader security controls are triggered.

YARA Rule

rule webshell_ASP_zehir {
	meta:
		description = "Web Shell - file zehir.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "0061d800aee63ccaf41d2d62ec15985d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s9 = "Response.Write \"<font face=wingdings size=3><a href='\"&dosyaPath&\"?status=18&"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file zehir.asp detection rule, along with recommended filters and exclusions:

• Scenario: Automated Backup or Migration Scripts

  • Context: Enterprise backup solutions like Veeam or Rubrik, or migration tools like SharePoint Migration Tool, often create temporary staging files in web directories during data synchronization. These scripts may generate a file named zehir.asp as part of a legacy template restoration process before deleting it immediately after the job completes.
  • Filter/Exclusion: Exclude file creation events where the source user is a dedicated service account (e.g., svc_backup, migrator_svc) and the file duration is less than 5 minutes. Alternatively, add an exclusion for the specific directory path used by these tools (e.g., \InetPub\wwwroot\temp_migration\).

• Scenario: Scheduled Health Check or Monitoring Agents

  • Context: Internal monitoring agents such as SolarWinds NPM, Datadog Agent, or custom PowerShell scripts running via Windows Task Scheduler often deploy lightweight ASP probes to verify web server connectivity. A scheduled job named “Daily Web Probe” might instantiate zehir.asp every morning at 02:00 AM to test IIS response times, which is a standard operational procedure rather than an intrusion.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name (e.g., TaskHost.exe, SolarWinds.Agent.exe) and a time window filter allowing this specific file creation only between 01:00 and 04:00 UTC daily.

• Scenario: CMS Content Deployment via CI/CD Pipelines

  • Context: In environments using Azure DevOps, Jenkins, or **GitHub Actions