Generic JSP webshell with base64 encoded payload

Hunt Hypothesis

This detection identifies adversaries deploying Java Server Pages (JSP) webshells that utilize Base64-encoded payloads to execute obfuscated commands and maintain persistent access within Azure-hosted applications. Proactively hunting for this behavior in Azure Sentinel is critical because encoded webshells often evade signature-based defenses, allowing attackers to establish a covert foothold before initiating lateral movement or data exfiltration.

YARA Rule

rule WEBSHELL_JSP_Generic_Base64
{
    meta:
        description = "Generic JSP webshell with base64 encoded payload"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        score = 75
        date = "2021/01/24"
        modified = "2025-08-18"
        hash = "8b5fe53f8833df3657ae2eeafb4fd101c05f0db0"
        hash = "1b916afdd415dfa4e77cecf47321fd676ba2184d"

        id = "2eabbad2-7d10-573a-9120-b9b763fa2352"
    strings:
        // Runtime
        $one1 = "SdW50aW1l" wide ascii
        $one2 = "J1bnRpbW" wide ascii
        $one3 = "UnVudGltZ" wide ascii
        $one4 = "IAdQBuAHQAaQBtAGUA" wide ascii
        $one5 = "SAHUAbgB0AGkAbQBlA" wide ascii
        $one6 = "UgB1AG4AdABpAG0AZQ" wide ascii
        // exec
        $two1 = "leGVj" wide ascii
        $two2 = "V4ZW" wide ascii
        $two3 = "ZXhlY" wide ascii
        $two4 = "UAeABlAGMA" wide ascii
        $two5 = "lAHgAZQBjA" wide ascii
        $two6 = "ZQB4AGUAYw" wide ascii
        // ScriptEngineFactory
        $three1 = "TY3JpcHRFbmdpbmVGYWN0b3J5" wide ascii
        $three2 = "NjcmlwdEVuZ2luZUZhY3Rvcn" wide ascii
        $three3 = "U2NyaXB0RW5naW5lRmFjdG9ye" wide ascii
        $three4 = "MAYwByAGkAcAB0AEUAbgBnAGkAbgBlAEYAYQBjAHQAbwByAHkA" wide ascii
        $three5 = "TAGMAcgBpAHAAdABFAG4AZwBpAG4AZQBGAGEAYwB0AG8AcgB5A" wide ascii
        $three6 = "UwBjAHIAaQBwAHQARQBuAGcAaQBuAGUARgBhAGMAdABvAHIAeQ" wide ascii


        //strings from private rule capa_jsp_safe
        $cjsp_short1 = "<%" ascii wide
        $cjsp_short2 = "%>" wide ascii
        $cjsp_long1 = "<jsp:" ascii wide
        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
        // JSF
        $cjsp_long3 = "/jstl/core" ascii wide
        $cjsp_long4 = "<%@p" nocase ascii wide
        $cjsp_long5 = "<%@ " nocase ascii wide
        $cjsp_long6 = "<% " ascii wide
        $cjsp_long7 = "< %" ascii wide

        //strings from private rule capa_bin_files
        $dex1 = "dex\n0"
        $dex2 = "dey\n0"
        $pack  = { 50 41 43 4b 00 00 00 02 00 }

    condition:
        (
        $cjsp_short1 at 0 or
            any of ( $cjsp_long* ) or
            ($cjsp_short1 and $cjsp_short2 in ( filesize-100..filesize )) or
        (
            $cjsp_short2 and (
                $cjsp_short1 in ( 0..1000 ) or
                $cjsp_short1 in ( filesize-1000..filesize )
            )
        )
        )
        and not (
        uint16(0) == 0x5a4d or
        $dex1 at 0 or
        $dex2 at 0 or
        $pack at 0 or
        // fp on jar with zero compression
        uint16(0) == 0x4b50
        )
        and filesize < 300KB and
        ( any of ( $one* ) and any of ( $two* ) or any of ( $three* ) )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 30 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Generic JSP webshell with base64 encoded payload detection rule, including suggested filters and exclusions:

• Scenario: Legitimate Backup or Migration Scripts

  • Context: Enterprise backup tools like Veeam, Commvault, or custom Python/Java migration scripts often utilize JSP endpoints to transfer large configuration files or binary data. These tools frequently encode payloads in Base64 within the HTTP POST body to ensure safe transmission across firewalls and proxy layers without character encoding issues.
  • Filter/Exclusion: Create an exclusion based on the User-Agent header containing specific strings (e.g., Veeam, Commvault, Jenkins) or filter by source IP ranges belonging to the backup infrastructure subnet (e.g., 10.20.50.0/24).

• Scenario: Scheduled Log Aggregation Jobs

  • Context: Centralized logging platforms such as Splunk Universal Forwarder, Elasticsearch Logstash, or Datadog Agent often push compressed log bundles to a JSP collector endpoint. To handle variable-length log entries, these agents may wrap the entire payload in a Base64 string before transmission via a scheduled cron job running every 5 minutes.
  • Filter/Exclusion: Exclude requests where the HTTP method is POST and the request URI matches known ingestion endpoints (e.g., /api/v1/logs/upload, /jsp/logCollector.jsp). Additionally, filter by time-based logic to only alert outside of standard maintenance windows (e.g., 02:00–04:00) if the job is strictly scheduled.

• Scenario: CI/CD Pipeline Artifact Uploads

  • Context: Continuous Integration tools like Jenkins, GitLab CI,