Web Shell - file 123.jsp

Hunt Hypothesis

This detection identifies adversaries deploying a malicious JSP web shell (123.jsp) to establish persistent remote access and execute arbitrary commands on compromised web servers. Proactive hunting for this behavior in Azure Sentinel is critical because web shells often serve as a primary foothold for lateral movement and data exfiltration, allowing attackers to maintain stealthy control over the environment before triggering broader alerts.

YARA Rule

rule webshell_jsp_123 {
	meta:
		description = "Web Shell - file 123.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "c691f53e849676cac68a38d692467641"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "<font color=\"blue\">??????????????????:</font><input type=\"text\" size=\"7"
		$s3 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
		$s9 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">    " fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are the documented false positive scenarios for the Web Shell - file 123.jsp detection rule, including specific contexts and recommended filters:

• Scenario: Automated Deployment of Standard Library Files via CI/CD Pipeline

  • Context: The organization’s DevOps team uses Jenkins or GitLab CI to deploy a standard utility library named 123.jsp (a generic placeholder name used in the legacy application framework) to the production Tomcat server during nightly builds. This file is part of the approved baseline and contains no interactive logic, merely static configuration data.
  • Filter/Exclusion: Create an exclusion rule based on the Source IP of the CI/CD runner (e.g., 10.20.30.5) and the Deployment Timestamp. Additionally, exclude this file if it is created by the specific service account used for deployments (e.g., svc-deploy-tomcat).

• Scenario: Scheduled Backup or Log Rotation Job Creating Temporary Artifacts

  • Context: A nightly scheduled job managed by Windows Task Scheduler (or a Linux Cron job) running under the admin-backup account executes a script that generates temporary JSP files in the web root for audit logging purposes. The file 123.jsp is created as a transient placeholder to trigger a specific log aggregation workflow before being deleted or overwritten within 15 minutes.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., between 02:00 and 04:00 UTC) for this specific file path. Alternatively, add an exclusion if the Process Name creating the file matches java.exe running under the admin-backup user context with a known PID range associated with backup services.

• Scenario: Administrator Manual Configuration or Hotfix Application *