Web Shell - file Inderxer.asp

Hunt Hypothesis

This detection identifies adversaries establishing a persistent web shell named “Inderxer.asp” to execute commands and maintain access within the Azure environment. Proactively hunting for this specific artifact is critical because web shells often serve as an initial foothold that enables attackers to pivot laterally, exfiltrate sensitive data, or deploy additional malware across the organization’s infrastructure.

YARA Rule

rule webshell_Inderxer {
	meta:
		description = "Web Shell - file Inderxer.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "9ea82afb8c7070817d4cdf686abe0300"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s4 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input typ"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file Inderxer.asp detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup or Archiving Tool Execution

  • Context: Enterprise backup solutions like Veeam, Commvault, or Acronis Cyber Protect often create temporary staging files in web root directories during nightly jobs. These tools may generate a file named Inderxer.asp (often a typo for “Indexer” in legacy scripts) to catalog assets before archiving, triggering the rule due to the .asp extension and location.
  • Suggested Filter/Exclusion: Exclude files created by specific service accounts (e.g., DOMAIN\BackupSvc) or filter out events where the parent process is a known backup executable (e.g., vbr.exe, commvault_agent.exe). Additionally, apply a time-based exclusion to ignore alerts occurring during defined maintenance windows (e.g., 02:00 – 04:00 AM).

• Scenario: Scheduled Indexing or Search Service Updates

  • Context: The Microsoft Windows Search Service or third-party enterprise search tools like Sitecore or Solr often run scheduled jobs to update the site index. These services frequently generate Inderxer.asp as a temporary handler script during the indexing cycle, which mimics the behavior of a web shell writing new files.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the parent process name (e.g., SearchIndexer.exe, wsearch.exe) and the user context (NT SERVICE\WSearch). If the file size remains static or is deleted within 5 minutes of creation, flag it as a benign temporary artifact rather than a persistent web shell.

• **Scenario: Legacy CMS Deployment via