Web Shell - file cmd_win32.jsp

Hunt Hypothesis

This detection identifies adversaries deploying a JSP-based web shell named cmd_win32.jsp to establish persistent remote command execution capabilities on compromised web servers. Proactively hunting for this artifact in Azure Sentinel is critical because such shells often serve as an initial foothold that enables attackers to execute arbitrary commands, exfiltrate sensitive data, and pivot deeper into the internal network before triggering broader alerting mechanisms.

YARA Rule

rule webshell_cmd_win32 {
	meta:
		description = "Web Shell - file cmd_win32.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "cc4d4d6cc9a25984aa9a7583c7def174"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /c \" + request.getParam"
		$s1 = "<FORM METHOD=\"POST\" NAME=\"myform\" ACTION=\"\">" fullword
	condition:
		2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file cmd_win32.jsp detection rule, including suggested filters and exclusions:

• Scenario: Automated Deployment via CI/CD Pipeline

  • Context: A DevOps team uses Jenkins or GitLab CI to deploy application updates. The pipeline script includes a step that copies the standard cmd_win32.jsp file (part of the base application artifact) into the Tomcat/IIS web root directory every morning at 08:00 AM via an automated build agent.
  • Filter/Exclusion: Create an exclusion rule based on the Source User/Process. Exclude events where the InitiatingProcessName is jenkins-agent.exe, gitlab-runner.exe, or msbuild.exe, and the AccountName matches the service account used by the CI tool (e.g., svc-deploy).

• Scenario: Scheduled Backup of Web Artifacts

  • Context: The enterprise runs a nightly backup job using Veeam or Rubrik. During the backup window, the agent reads and temporarily stages web files to ensure consistency. This process triggers file creation events for standard JSP files like cmd_win32.jsp within the application directory without actually modifying the content permanently in a way that suggests a new shell upload.
  • Filter/Exclusion: Implement a time-based exclusion or process filter. Exclude alerts where the InitiatingProcessName is VeeamAgent.exe (or specific backup software processes) occurring between 02:00 and 04:00 daily. Alternatively, exclude if the file hash matches the known “Golden Image” hash of the legitimate application artifact.

• Scenario: Admin Manual Maintenance via Remote Desktop

  • Context: A System Administrator logs into