Web Shell - file cmd-asp-5.1.asp

Hunt Hypothesis

This detection identifies adversary behavior where attackers deploy a specific ASP web shell (cmd-asp-5.1.asp) to establish persistent remote command execution access on compromised web servers. Proactive hunting for this artifact in Azure Sentinel is critical because web shells serve as a primary foothold for post-exploitation activities, enabling threat actors to execute arbitrary commands and maintain stealthy persistence within the environment.

YARA Rule

rule webshell_cmd_asp_5_1 {
	meta:
		description = "Web Shell - file cmd-asp-5.1.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s9 = "Call oS.Run(\"win.com cmd.exe /c \"\"\" & szCMD & \" > \" & szTF &" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Web Shell - file cmd-asp-5.1.asp detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup or Reporting Scripts

  • Context: A legacy IIS web server hosts a scheduled task (Windows Task Scheduler) that runs nightly to generate PDF reports. The script utilizes cmd-asp-5.1.asp as the execution engine to invoke command-line tools like Robocopy or PowerShell for data aggregation before archiving logs to a network share.
  • Suggested Filter/Exclusion: Create an exclusion based on the specific file path (e.g., C:\InetPub\wwwroot\Reports\Scripts\cmd-asp-5.1.asp) and restrict detection to non-business hours if the script runs exclusively at night, or exclude events where the source process is svchost.exe with a known service name like “Task Scheduler”.

• Scenario: DevOps Deployment Pipeline Execution

  • Context: During a CI/CD pipeline run (using tools like Jenkins, Azure DevOps, or GitHub Actions), an automated deployment agent pushes configuration updates to the staging environment. The deployment script temporarily instantiates cmd-asp-5.1.asp to execute pre-deployment health checks and post-deployment verification commands against the web application.
  • Suggested Filter/Exclusion: Exclude events where the source IP address belongs to the internal CI/CD subnet (e.g., 10.20.x.x) or filter by User Agent strings containing specific identifiers like “Jenkins” or “Azure-DevOps-Agent”. Additionally, correlate with deployment logs to auto-suppress alerts during known maintenance windows.

• Scenario: Third-Party Monitoring and Health Check Agents

  • Context: Enterprise monitoring solutions (such as Solar