Web Shell - file mdb.asp

Hunt Hypothesis

This detection identifies adversaries deploying an mdb.asp web shell to establish a persistent foothold and execute commands on compromised IIS servers. Proactive hunting for this specific artifact in Azure Sentinel is critical because web shells often serve as the initial entry point for lateral movement and data exfiltration, requiring immediate investigation before attackers can expand their presence.

YARA Rule

rule webshell_caidao_shell_mdb {
	meta:
		description = "Web Shell - file mdb.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "fbf3847acef4844f3a0d04230f6b9ff9"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "<% execute request(\"ice\")%>a " fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file mdb.asp detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Reporting Generation by Business Intelligence Tools

  • Context: Enterprise BI tools like Microsoft Power BI Report Server or SAP BusinessObjects often generate temporary .asp files named mdb.asp (or similar) in the IIS web root to render dynamic database connection reports. These files are created, executed, and sometimes deleted by the application service account during scheduled report refreshes.
  • Filter/Exclusion: Exclude file creation events where the parent process is w3wp.exe running under the IIS AppPool\ReportServerAppPool (or specific BI app pools) and the user principal name matches the BI Service Account (e.g., svc-bi-reporting).

• Scenario: Legacy Database Migration Scripts

  • Context: During scheduled nightly maintenance windows, DBAs use legacy migration scripts hosted on IIS to convert old Access databases (.mdb) to SQL formats. These scripts often instantiate a temporary web handler named mdb.asp to process the file conversion before cleanup. This is common in environments utilizing Microsoft Access Services or custom .NET wrappers for data ingestion.
  • Filter/Exclusion: Create an exclusion rule based on time-of-day (e.g., 02:00–04:00 local time) and the specific file path C:\InetPub\wwwroot\Maintenance\mdb.asp. Additionally, filter out events where the file size remains constant or is deleted within 15 minutes of creation.

• Scenario: Scheduled Health Check Probes by Load Balancers

  • Context: External load balancers (such as F5 BIG-IP, Citrix ADC, or **