Web Shell - file cmdjsp.jsp

Hunt Hypothesis

This detection identifies adversaries deploying a cmdjsp.jsp web shell to establish a persistent foothold for remote command execution and lateral movement within web applications. Proactive hunting is essential in Azure Sentinel to rapidly identify these often-overlooked artifacts before attackers leverage them for data exfiltration or privilege escalation.

YARA Rule

rule webshell_jsp_cmdjsp_2 {
	meta:
		description = "Web Shell - file cmdjsp.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "1b5ae3649f03784e2a5073fa4d160c8b"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /C \" + cmd);" fullword
		$s4 = "<FORM METHOD=GET ACTION='cmdjsp.jsp'>" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file cmdjsp.jsp detection rule, including suggested filters and exclusions:

• Scheduled Backup or Reporting Job by Enterprise Tools

  • Scenario: Automated backup solutions like Veeam, Commvault, or reporting suites such as Splunk Universal Forwarder often deploy temporary JSP files named cmdjsp.jsp (or similar variants) within the web root to facilitate status checks, log collection, or remote command execution during nightly maintenance windows.
  • Filter/Exclusion: Exclude the rule for file paths containing specific backup directories (e.g., /backup/reports/, /logs/temp/) and restrict detection to business hours only if the tool runs exclusively after 6:00 PM. Alternatively, whitelist the specific Service Account (e.g., svc-backup-agent) that performs these writes.

• CI/CD Pipeline Deployment Artifacts

  • Scenario: During a continuous integration and deployment cycle using tools like Jenkins, GitLab CI, or Azure DevOps, the pipeline may temporarily upload a generic command interface file named cmdjsp.jsp to the staging environment as part of a smoke test suite before promoting it to production. This often occurs in ephemeral containers or temporary build directories.
  • Filter/Exclusion: Create an exclusion based on the source IP address range of the CI/CD pipeline runners (e.g., 10.20.30.x). Additionally, filter out events where the file modification timestamp falls within a known deployment window defined in the orchestration tool’s schedule.

• Legacy Application Maintenance by DevOps Administrators

  • Scenario: System administrators utilizing legacy Java-based applications (e.g., IBM WebSphere, Apache Tomcat) may manually deploy cmdjsp.jsp as a standard utility