Web Shell - file hkmjj.asp

Hunt Hypothesis

This detection rule identifies the creation of a suspicious web shell named hkmjj.asp, which adversaries often deploy to establish persistent remote access and execute commands on compromised web servers. Proactive hunting for this artifact in Azure Sentinel is critical because web shells serve as a primary foothold for attackers to pivot within the network, exfiltrate sensitive data, or escalate privileges before triggering broader alerts.

YARA Rule

rule webshell_caidao_shell_hkmjj {
	meta:
		description = "Web Shell - file hkmjj.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "e7b994fe9f878154ca18b7cde91ad2d0"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s6 = "codeds=\"Li#uhtxhvw+%{{%,#@%{%#wkhq#hydo#uhtxhvw+%knpmm%,#hqg#li\"  " fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file hkmjj.asp detection rule, along with suggested filters or exclusions:

• Scenario: Automated Backup Script Execution

  • Context: The enterprise uses a custom backup utility (e.g., Veeam or a PowerShell wrapper) that periodically generates temporary ASPX/ASP files in the web root to log status. A scheduled job running under the SYSTEM or BackupService account creates hkmjj.asp as a transient logging artifact during nightly maintenance windows.
  • Filter/Exclusion: Exclude alerts where the Source User is NT SYSTEM, BackupService, or a known service account, and the file creation time falls within the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: CI/CD Pipeline Artifact Deployment

  • Context: The DevOps team utilizes Jenkins or Azure DevOps to deploy updates to the IIS web server. During a deployment pipeline, the build agent (running as BuildAgent) temporarily creates hkmjj.asp in the C:\inetpub\wwwroot directory as part of a staging verification step before promoting it to production.
  • Filter/Exclusion: Filter out events where the Process Name is jenkins.exe, azagentworker.exe, or msbuild.exe, and the file path matches the deployment staging directory (e.g., \Staging\).

• Scenario: Third-Party Analytics Module Installation

  • Context: A legitimate third-party analytics tool (such as Google Tag Manager custom container or a specific CRM plugin) is installed on the web server. The installer creates hkmjj.asp as a standard entry point for tracking scripts, which remains static and does not exhibit shell-like behavior (e.g