Web Shell - file elmaliseker.asp

Hunt Hypothesis

This rule detects adversaries deploying a malicious web shell named elmaliseker.asp to establish persistence and execute commands on compromised web servers within the Azure environment. Proactive hunting for this specific file is critical because web shells often serve as an initial foothold for attackers, enabling them to move laterally across the network or exfiltrate sensitive data before traditional alerts trigger.

YARA Rule

rule webshell_elmaliseker_2 {
	meta:
		description = "Web Shell - file elmaliseker.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "<td<%if (FSO.GetExtensionName(path & \"\\\" & oFile.Name)=\"lnk\") or (FSO.GetEx"
		$s6 = "<input type=button value=Save onclick=\"EditorCommand('Save')\"> <input type=but"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file elmaliseker.asp detection rule, including targeted filters and exclusions:

• Scheduled Backup Job Execution

  • Scenario: The enterprise backup solution (e.g., Veeam Agent or Commvault) performs nightly incremental backups of the IIS web root. During this process, the backup agent creates a temporary staging file named elmaliseker.asp within the C:\inetpub\wwwroot\App_Reports directory to verify checksum integrity before archiving.
  • Filter/Exclusion: Exclude files created by the specific Service Account (e.g., DOMAIN\VeeamBackupSvc) in the backup staging folder path: C:\inetpub\wwwroot\App_Reports\*.asp.

• Legacy CRM Module Deployment

  • Scenario: The internal IT team deploys a legacy Customer Relationship Management module using Microsoft Azure DevOps. This specific module includes a custom utility script named elmaliseker.asp used for email validation logic, which is deployed to the production server via an automated CI/CD pipeline during business hours.
  • Filter/Exclusion: Create a whitelist entry for files where the “Owner” attribute matches the deployment account (e.g., DOMAIN\DevOpsBot) and the file path contains \Modules\CRM\Utils\.

• Automated Security Scanning Tool

  • Scenario: The organization runs Qualys Cloud Agent or Tenable Nessus to perform daily vulnerability scans. As part of the web server assessment, the scanner injects a test probe file named elmaliseker.asp into the public directory to verify HTTP response headers and file permissions before removing it immediately after the scan completes.
  • Filter/Exclusion: Exclude events where the parent process is `