Web Shell - file zehir4.asp

Hunt Hypothesis

This detection identifies the creation of a suspicious web shell named zehir4.asp, which adversaries often deploy to establish persistent access and execute commands on compromised web servers. Proactively hunting for this artifact in Azure Sentinel is critical because web shells serve as a primary foothold for post-exploitation activities, enabling attackers to move laterally across the environment or exfiltrate sensitive data before traditional alerts trigger.

YARA Rule

rule webshell_ASP_zehir4 {
	meta:
		description = "Web Shell - file zehir4.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "7f4e12e159360743ec016273c3b9108c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s9 = "Response.Write \"<a href='\"&dosyaPath&\"?status=7&Path=\"&Path&\"/"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file zehir4.asp detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup or Migration Script Execution

  • Context: An enterprise backup solution (e.g., Veeam or Commvault) performs nightly web server content synchronization. The script temporarily creates a staging file named zehir4.asp in the IIS root directory to validate file integrity before archiving, which mimics the behavior of a dropped web shell.
  • Filter/Exclusion: Add an exclusion for file creation events where the parent process is vcsmagent.exe (Veeam) or commvault.exe, and the source IP belongs to the internal backup subnet range (e.g., 10.20.x.x).

• Scenario: Third-Party Analytics or Monitoring Agent Deployment

  • Context: A monitoring tool like SolarWinds SiteScope or Datadog Agent deploys a lightweight ASP probe named zehir4.asp to the web server’s default directory. This file is used periodically to check HTTP response codes and latency, appearing as a new executable script in the logs.
  • Filter/Exclusion: Exclude events where the user account is a dedicated service account (e.g., svc-monitoring) and the file path matches the specific monitoring agent’s deployment directory (e.g., C:\Program Files\SolarWinds\SiteScope\webprobes).

• Scenario: Scheduled Deployment via CI/CD Pipeline

  • Context: A DevOps pipeline using Azure DevOps or Jenkins triggers a scheduled release job. As part of the deployment workflow, a specific utility script named zehir4.asp is pushed to the staging environment to handle pre-deployment configuration validation before the main application