Web Shell - file action.jsp

Hunt Hypothesis

This detection identifies adversaries deploying malicious web shells named action.jsp to establish a persistent foothold and execute commands on compromised web servers. SOC teams should proactively hunt for this indicator in Azure Sentinel because web shells are frequently used as an initial entry point for lateral movement and data exfiltration, often evading standard signature-based defenses due to their legitimate appearance within application directories.

YARA Rule

rule webshell_jsp_action {
	meta:
		description = "Web Shell - file action.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "5a7d931094f5570aaf5b7b3b06c3d8c0"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "String url=\"jdbc:oracle:thin:@localhost:1521:orcl\";" fullword
		$s6 = "<%@ page contentType=\"text/html;charset=gb2312\"%>" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file action.jsp detection rule, along with recommended filters and exclusions:

• Scheduled Backup Automation via Jenkins Pipeline

  • Scenario: A nightly CI/CD pipeline (e.g., Jenkins or GitLab Runner) deploys a standard action.jsp configuration file to the Tomcat webapps directory as part of a routine backup verification script. The deployment process creates the file with identical timestamps and permissions, triggering the rule despite being an authorized operation.
  • Filter/Exclusion: Exclude events where the source user is the service account svc-jenkins-deploy AND the parent process name matches java.exe (JVM) running under the Jenkins master node PID range.

• Legitimate Admin Maintenance via IIS Manager

  • Scenario: An application administrator performs a manual update of the web portal’s login module using Microsoft IIS Manager or PowerShell (New-Item). They create action.jsp in the root directory to test a new authentication flow, which mimics the behavior of a malicious shell upload.
  • Filter/Exclusion: Create an exclusion for files created by the built-in user NT AUTHORITY\SYSTEM or specific admin groups (e.g., Domain Admins) where the file path contains \inetpub\wwwroot\maintenance\.

• Automated Reporting Tool Deployment

  • Scenario: An enterprise reporting tool (such as Tableau Server or Microsoft Power BI Report Server) automatically generates a temporary JSP wrapper named action.jsp during its scheduled report refresh cycle. This file acts as a bridge for data visualization and is recreated periodically by the application service.
  • Filter/Exclusion: Filter out alerts where the source process is TableauService.exe or w3wp.exe (Application Pool: ReportServerAppPool)