Web Shell - from files config.jsp, myxx.jsp, zend.jsp

Hunt Hypothesis

This detection identifies adversaries deploying malicious web shells within specific JSP configuration and utility files to establish persistent access points for remote command execution on web servers. Proactively hunting for these artifacts in Azure Sentinel is critical because attackers often leverage these common file names to blend with legitimate traffic, enabling them to maintain stealthy footholds that facilitate lateral movement and data exfiltration.

YARA Rule

rule webshell_config_myxx_zend {
	meta:
		description = "Web Shell - from files config.jsp, myxx.jsp, zend.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		super_rule = 1
		hash0 = "d44df8b1543b837e57cc8f25a0a68d92"
		hash1 = "e0354099bee243702eb11df8d0e046df"
		hash2 = "591ca89a25f06cf01e4345f98a22845c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s3 = ".println(\"<a href=\\\"javascript:alert('You Are In File Now ! Can Not Pack !');"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell detection rule targeting config.jsp, myxx.jsp, and zend.jsp, along with recommended filters:

• Automated Configuration Backup by Jenkins Pipeline

  • Scenario: A nightly Jenkins CI/CD job executes a deployment script that writes updated configuration parameters to config.jsp on the application server. The rule triggers because the write operation involves file modification and potential HTTP POST requests from the build agent IP, mimicking web shell activity.
  • Filter/Exclusion: Exclude traffic originating from the specific Jenkins Controller IP range (e.g., 10.20.5.10) where the destination path matches /app/config.jsp and the user-agent contains “Jenkins”.

• Scheduled Zendesk Data Sync Job

  • Scenario: An internal scheduled task runs every hour to sync customer data between the CRM and the web portal, utilizing zend.jsp as the ingestion endpoint. The job performs frequent read/write operations that generate high-volume HTTP requests, which the rule interprets as suspicious shell execution.
  • Filter/Exclusion: Create a whitelist for the service account identity (e.g., svc-zend-sync) and exclude alerts where the source port is consistent with the internal scheduler (e.g., Port 8085) accessing /api/zend.jsp.

• Legacy Admin Portal Maintenance via myxx.jsp

  • Scenario: The IT Operations team uses a legacy administrative dashboard that relies on myxx.jsp for real-time log monitoring and user session management. During peak business hours, heavy usage by multiple administrators triggers the rule due to concurrent file access patterns resembling shell command execution.
  • Filter/Exclusion: Exclude alerts where the HTTP Method is GET (indicating read-only monitoring rather than command execution) and the source IP belongs