Web Shell - file ELMALISEKER Backd00r.asp

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying malicious web shells like “Backd00r.asp” to establish persistent access and execute commands on compromised Azure web servers. Proactively hunting for this behavior in Azure Sentinel is critical because web shells often operate with low visibility, allowing attackers to maintain a foothold and pivot within the environment before triggering standard alert thresholds.

YARA Rule

rule webshell_ELMALISEKER_Backd00r {
	meta:
		description = "Web Shell - file ELMALISEKER Backd00r.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "3aa403e0a42badb2c23d4a54ef43e2f4"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "response.write(\"<tr><td bgcolor=#F8F8FF><input type=submit name=cmdtxtFileOptio"
		$s2 = "if FP = \"RefreshFolder\" or request.form(\"cmdOption\")=\"DeleteFolder\" or req"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file ELMALISEKER Backd00r.asp detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup or Migration Scripts

  • Context: Enterprise backup solutions like Veeam, Rubrik, or custom PowerShell scripts using IIS Web Deploy often create temporary .asp files in web root directories during data synchronization or migration tasks. These tools may generate a file named Backd00r.asp (or similar variants) as part of a staging process before archiving.
  • Filter/Exclusion: Exclude the rule if the file is created by known service accounts (e.g., DOMAIN\BackupSvc, SYSTEM) and the source IP belongs to the internal backup infrastructure subnet (e.g., 10.x.x.x). Additionally, filter out files where the “Last Modified” timestamp matches a scheduled maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: DevOps CI/CD Pipeline Deployment

  • Context: During automated deployments via tools like Azure DevOps, Jenkins, or GitHub Actions, the build pipeline may deploy a legacy .asp component named Backd00r.asp as part of an application update. This often occurs when deploying to IIS servers where the deployment agent creates the file directly in the wwwroot folder.
  • Filter/Exclusion: Create an exclusion for events originating from specific CI/CD runner IPs or service accounts (e.g., DOMAIN\DevOpsAgent). Implement a logic check that suppresses alerts if the file hash matches a known “golden image” hash stored in the configuration management database (CMDB) for this specific application component.

• Scenario: Scheduled Administrative Maintenance Tasks *