Web Shell - file ice.asp

Hunt Hypothesis

This detection identifies the creation of a suspicious web shell named ice.asp, which adversaries often deploy to establish persistent access and execute commands on compromised web servers. Proactively hunting for this artifact in Azure Sentinel is critical because web shells serve as a primary foothold for attackers to escalate privileges, exfiltrate data, or move laterally within the environment before triggering other alerts.

YARA Rule

rule webshell_caidao_shell_ice {
	meta:
		description = "Web Shell - file ice.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "6560b436d3d3bb75e2ef3f032151d139"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "<%eval request(\"ice\")%>" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Web Shell - file ice.asp” detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Backup Script Execution

  • Context: The organization uses a custom backup utility that periodically generates temporary reporting files named ice.asp within the IIS web root to log successful archive operations before being deleted.
  • Filter/Exclusion: Exclude the specific file path (e.g., C:\InetPub\wwwroot\logs\ice.asp) and limit the rule scope to exclude processes spawned by the backup service account (e.g., NT SERVICE\BackupAgent or a dedicated service account like svc-backup).

• Scenario: CI/CD Pipeline Deployment Artifacts

  • Context: During automated deployment cycles, the DevOps team utilizes Azure DevOps or Jenkins pipelines that temporarily stage an ice.asp file as part of a health check verification step before promoting the application to production.
  • Filter/Exclusion: Create an exclusion based on the parent process name (e.g., Taskeng.exe, msbuild.exe, or jenkins-agent) and restrict the alert to only trigger if the file persists beyond a specific time window (e.g., >15 minutes) rather than immediate creation.

• Scenario: Scheduled Maintenance Health Checks

  • Context: A scheduled Windows Task runs nightly to verify web server connectivity, which dynamically creates an ice.asp script to test database connections and render a status page for internal monitoring dashboards.
  • Filter/Exclusion: Exclude events occurring within the defined maintenance window (e.g., 02:00–04:00 UTC) or filter by the specific scheduled task name (e.g., WebServerHealthCheck) in the event metadata.