Web Shell - file 12302.jsp

Hunt Hypothesis

This rule detects adversaries deploying a malicious JSP web shell (file 12302.jsp) to establish persistent access and execute commands on compromised web servers. Proactive hunting for this artifact in Azure Sentinel is critical because web shells often serve as the initial foothold for attackers, enabling them to pivot laterally or exfiltrate sensitive data before triggering broader alerts.

YARA Rule

rule webshell_jsp_12302 {
	meta:
		description = "Web Shell - file 12302.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "a3930518ea57d899457a62f372205f7f"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "</font><%out.print(request.getRealPath(request.getServletPath())); %>" fullword
		$s1 = "<%@page import=\"java.io.*,java.util.*,java.net.*\"%>" fullword
		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the Web Shell - file 12302.jsp detection rule, including actionable filters and exclusions:

• Scheduled Backup of Legacy JSP Artifacts

  • Scenario: The enterprise backup solution (e.g., Veeam or Rubrik) performs a nightly incremental backup of the Tomcat web application directory. During this process, the backup agent creates a temporary staging file named 12302.jsp within the deployment folder to verify checksum integrity before archiving.
  • Filter/Exclusion: Exclude alerts where the source IP matches the Backup Proxy Server (e.g., 192.168.10.5) and the process name is vbrservice.exe or rubrik-agent. Additionally, filter out events occurring during the defined maintenance window (e.g., 02:00–04:00 UTC).

• CI/CD Pipeline Deployment of Microservices

  • Scenario: The DevOps team utilizes Jenkins with a Kubernetes cluster to deploy new microservice versions. As part of the deployment manifest, a standardized test artifact named 12302.jsp is automatically generated and written to the container’s filesystem by the Helm Chart controller during the “staging” phase before traffic routing begins.
  • Filter/Exclusion: Create an exclusion rule for file creation events originating from the Jenkins Controller IP range (e.g., 10.20.30.0/24) where the user context is svc-jenkins-deployer. The filter should also check if the file size remains constant across multiple deployments of this specific artifact name.

• Automated Health Check by Load Balancer

  • Scenario: The **F5 BIG