Web Shell - from files browser.jsp, 201.jsp, 3.jsp, ma.jsp, download.jsp

Hunt Hypothesis

This detection identifies potential web shell deployments by monitoring suspicious activity associated with specific JSP files (browser.jsp, 201.jsp, 3.jsp, ma.jsp, and download.jsp) that adversaries often leverage to establish persistent access and execute commands on compromised servers. Proactively hunting for these indicators in Azure Sentinel is critical because web shells serve as a primary foothold for attackers to maintain long-term presence, exfiltrate data, and pivot within the environment before triggering broader alerting mechanisms.

YARA Rule

rule webshell_browser_201_3_ma_download {
	meta:
		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, ma.jsp, download.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
		hash3 = "4cc68fa572e88b669bce606c7ace0ae9"
		hash4 = "fa87bbd7201021c1aefee6fcc5b8e25a"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s2 = "<small>jsp File Browser version <%= VERSION_NR%> by <a"
		$s3 = "else if (fName.endsWith(\".mpg\") || fName.endsWith(\".mpeg\") || fName.endsWith"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the Web Shell detection rule targeting browser.jsp, 201.jsp, 3.jsp, ma.jsp, and download.jsp, along with recommended filters:

• Scheduled Backup & Reporting Jobs

  • Scenario: An automated nightly backup script or a reporting agent (e.g., Cron jobs on Linux or Windows Task Scheduler) executes a query against the application server to generate daily logs. The job accesses browser.jsp and download.jsp to fetch metadata, triggering the rule due to the high volume of requests during the maintenance window.
  • Filter/Exclusion: Exclude traffic originating from specific internal IP ranges (e.g., 10.20.x.x) or hostnames containing “backup-agent” during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Legitimate Admin Dashboard Access

  • Scenario: System administrators using the internal portal (e.g., via ServiceNow, Jira, or a custom BMC Remedy dashboard) regularly access ma.jsp and 3.jsp to monitor server health, view logs, or manage user permissions. These legitimate administrative sessions often involve complex form submissions that mimic web shell activity patterns.
  • Filter/Exclusion: Create an exclusion for requests where the User-Agent header contains specific admin tool identifiers (e.g., “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit… [Admin-Portal]”) and the source IP belongs to the corporate management VLAN.

• CI/CD Pipeline Integration Tests

  • Scenario: During a deployment cycle, the CI/CD platform (e.g., Jenkins, GitLab CI, or Azure DevOps) runs integration tests against the staging