Web Shell - file indexx.asp

Hunt Hypothesis

This detection identifies adversaries establishing a web shell named indexx.asp, which often indicates an attacker has successfully compromised a web server to gain persistent access and execute commands. SOC teams should proactively hunt for this anomaly in Azure Sentinel because web shells are frequently used as the initial foothold for lateral movement, data exfiltration, or command-and-control operations within cloud-hosted applications.

YARA Rule

rule webshell_DarkBlade1_3_asp_indexx {
	meta:
		description = "Web Shell - file indexx.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "b7f46693648f534c2ca78e3f21685707"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s3 = "Const strs_toTransform=\"command|Radmin|NTAuThenabled|FilterIp|IISSample|PageCou"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file indexx.asp detection rule, including recommended filters and exclusions:

• Scenario: Automated Backup or Migration Scripts

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) or migration tools often create temporary staging files with similar naming conventions. During a nightly data sync to an IIS server, the tool might generate a file named indexx.asp as a placeholder or checksum manifest before renaming it to the final state.
  • Filter/Exclusion: Exclude the specific service account used by the backup agent (e.g., DOMAIN\VeeamService) and restrict the rule to trigger only when the file creation time falls outside of the scheduled maintenance window (e.g., 02:00 – 04:00 UTC).

• Scenario: CI/CD Pipeline Deployment Artifacts

  • Context: During a continuous integration/deployment cycle using tools like Jenkins, Azure DevOps, or GitHub Actions, automated build agents deploy web applications to the production IIS server. The deployment script may temporarily instantiate indexx.asp as part of a “staging” directory structure before the final artifact is promoted and renamed.
  • Filter/Exclusion: Create an exclusion for file paths located within known CI/CD staging directories (e.g., C:\inetpub\temp\deploy_staging\*) or filter out events where the parent process is a deployment tool executable such as msbuild.exe, octopus.exe, or jenkins-agent.exe.

• Scenario: Scheduled Reporting Job Execution

  • Context: A scheduled task running via Windows Task Scheduler executes a custom reporting engine (e.g., Crystal Reports, Tableau Server) that generates dynamic ASP pages for internal dashboards. The job may create an interim file named `index