Web Shell - file customize.jsp

Hunt Hypothesis

This detection identifies adversaries deploying a malicious customize.jsp web shell to establish persistent access and execute commands on compromised web servers. Proactively hunting for this artifact in Azure Sentinel is critical because JSP-based shells often evade standard signature-based defenses by blending with legitimate application files, allowing attackers to maintain stealthy command-and-control channels.

YARA Rule

rule webshell_customize {
	meta:
		description = "Web Shell - file customize.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "d55578eccad090f30f5d735b8ec530b1"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file customize.jsp detection rule, including tailored filters and exclusions:

• Scenario: Scheduled Backup or Reporting Job Execution

  • Context: Enterprise data warehouses often utilize customize.jsp as a standard entry point for nightly reporting scripts that dynamically generate PDFs or CSV exports. These jobs run via the Java Scheduler (e.g., Quartz) on the application server, creating temporary file modifications or writes to this specific JSP without malicious intent.
  • Filter/Exclusion: Create an exclusion based on the Process Name and Time Window. Exclude alerts where process_name is java.exe (or the specific app server process like tomcat.exe) AND the event occurs between 02:00 and 04:00 local time during business hours.

• Scenario: Legitimate Administrator Deployment via CI/CD Pipeline

  • Context: DevOps teams frequently deploy updates to the web application layer using tools like Jenkins, GitLab CI, or Azure DevOps. During a deployment, the pipeline agent connects to the server and overwrites customize.jsp with a new version as part of the standard release workflow.
  • Filter/Exclusion: Filter alerts where the Source IP belongs to the known CI/CD subnet (e.g., 10.50.x.x) AND the User Account is a service account named svc-deploy or admin-ci.

• Scenario: Automated Content Management System (CMS) Updates

  • Context: In environments using CMS platforms like Liferay, WebSphere Portal, or custom Java-based portals, content editors often use the “Customize” module to update page layouts. This action triggers a file write event on customize.jsp as the system saves