Web Shell - file system.jsp

Hunt Hypothesis

This detection rule identifies adversary behavior where attackers deploy a .jsp web shell to establish persistent access and execute arbitrary commands on compromised web servers. A SOC team should proactively hunt for this activity in Azure Sentinel because web shells serve as a critical foothold for lateral movement and data exfiltration, often evading standard perimeter defenses by operating within trusted application layers.

YARA Rule

rule webshell_drag_system {
	meta:
		description = "Web Shell - file system.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "15ae237cf395fb24cf12bff141fb3f7c"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s9 = "String sql = \"SELECT * FROM DBA_TABLES WHERE TABLE_NAME not like '%$%' and num_"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file system.jsp detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scheduled Backup or Migration Jobs via Management Tools

  • Scenario: Automated backup solutions (e.g., Veeam, Commvault) or migration scripts running on the web server may periodically create temporary .jsp files in staging directories to verify connectivity or perform integrity checks before archiving. These legitimate processes often write standard JSP templates that mimic shell behavior.
  • Filter/Exclusion: Exclude file creation events where the source process is a known backup service (e.g., veeam.exe, commvault_agent) and the destination path resides within specific backup staging folders (e.g., C:\Backup\Staging\).

• CI/CD Pipeline Deployment Artifacts

  • Scenario: During routine application updates, CI/CD platforms like Jenkins, GitLab Runner, or Azure DevOps deploy new application artifacts to the web server. The deployment agent often extracts and writes .jsp files (including health check endpoints) as part of the standard build pipeline execution.
  • Filter/Exclusion: Create an exclusion for file creation events triggered by known CI/CD agents (e.g., jenkins-agent.exe, gitlab-runner) occurring within the application deployment directory (e.g., \tomcat\webapps\app-name\).

• Administrative Health Check and Monitoring Probes

  • Scenario: Enterprise monitoring tools such as SolarWinds, Datadog, or New Relic frequently execute synthetic transactions to verify web server health. These probes often generate temporary .jsp files containing diagnostic logic to test response times and error codes, which can be flagged as potential shell activity.
  • **Filter/Ex