Generic JSP webshell which uses classloader to execute user input

Hunt Hypothesis

This detection identifies adversaries deploying generic JSP webshells that leverage the Java ClassLoader to dynamically execute untrusted user input, a technique often used to establish persistent remote access and command execution capabilities on compromised servers. SOC teams should proactively hunt for this behavior in Azure Sentinel because such webshells frequently bypass standard signature-based defenses by utilizing legitimate runtime mechanisms, allowing attackers to maintain stealthy footholds within the application layer before escalating privileges or exfiltrating sensitive data.

YARA Rule

rule WEBSHELL_JSP_Generic_Classloader
{
    meta:
        description = "Generic JSP webshell which uses classloader to execute user input"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        score = 75
        hash = "6b546e78cc7821b63192bb8e087c133e8702a377d17baaeb64b13f0dd61e2347"
        date = "2021/01/07"
        modified = "2024-12-09"
        hash = "f3a7e28e1c38fa5d37811bdda1d6b0893ab876023d3bd696747a35c04141dcf0"
        hash = "8ea2a25344e6094fa82dfc097bbec5f1675f6058f2b7560deb4390bcbce5a0e7"
        hash = "b9ea1e9f91c70160ee29151aa35f23c236d220c72709b2b75123e6fa1da5c86c"
        hash = "80211c97f5b5cd6c3ab23ae51003fd73409d273727ba502d052f6c2bd07046d6"
        hash = "8e544a5f0c242d1f7be503e045738369405d39731fcd553a38b568e0889af1f2"

        id = "037e6b24-9faf-569b-bb52-dbe671ab2e87"
    strings:
        $exec = "extends ClassLoader" wide ascii
        $class = "defineClass" fullword wide ascii

        //strings from private rule capa_jsp_safe
        $cjsp_short1 = "<%" ascii wide
        $cjsp_short2 = "%>" wide ascii
        $cjsp_long1 = "<jsp:" ascii wide
        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
        // JSF
        $cjsp_long3 = "/jstl/core" ascii wide
        $cjsp_long4 = "<%@p" nocase ascii wide
        $cjsp_long5 = "<%@ " nocase ascii wide
        $cjsp_long6 = "<% " ascii wide
        $cjsp_long7 = "< %" ascii wide

        //strings from private rule capa_jsp_input
        // request.getParameter
        $input1 = "getParameter" fullword ascii wide
        // request.getHeaders
        $input2 = "getHeaders" fullword ascii wide
        $input3 = "getInputStream" fullword ascii wide
        $input4 = "getReader" fullword ascii wide
        $req1 = "request" fullword ascii wide
        $req2 = "HttpServletRequest" fullword ascii wide
        $req3 = "getRequest" fullword ascii wide

    condition:
        //any of them or
        (
            (
                $cjsp_short1 at 0 or
                    any of ( $cjsp_long* ) or
                    ($cjsp_short1 and $cjsp_short2 in ( filesize-100..filesize )) or
                (
                    $cjsp_short2 and (
                        $cjsp_short1 in ( 0..1000 ) or
                        $cjsp_short1 in ( filesize-1000..filesize )
                    )
                )
            )
            and (
                any of ( $input* ) and
                any of ( $req* )
            )
            and $exec and $class
        ) and
        (
            filesize < 10KB or
            (
                filesize < 50KB and
                (
                    // filled with same characters
                    math.entropy(500, filesize-500) <= 1 or
                    // filled with random garbage
                    math.entropy(500, filesize-500) >= 7.7
                )
            )
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 18 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Generic JSP webshell using classloader” detection rule, along with recommended filters and exclusions:

• Scenario: Automated Build Pipeline Execution

  • Context: CI/CD tools like Jenkins or GitLab CI often deploy artifacts to Tomcat servers. During deployment, the pipeline triggers a JSP script that dynamically loads new classes via ClassLoader to verify the build integrity before finalizing the release. This legitimate activity mimics the behavior of a webshell injecting and executing code.
  • Filter/Exclusion: Create an exclusion rule based on the source IP address range of your CI/CD servers (e.g., 10.20.50.0/24) or filter events where the HTTP User-Agent contains specific identifiers like Jenkins or GitLab-ci.

• Scenario: Scheduled Health Check and Metrics Collection

  • Context: Internal monitoring solutions such as Prometheus (via JMX exporters) or Datadog Agent perform scheduled health checks. These agents often invoke a specific JSP endpoint that utilizes the classloader to instantiate custom metrics classes for real-time reporting on JVM performance, triggering the detection logic without malicious intent.
  • Filter/Exclusion: Exclude traffic originating from known monitoring service accounts or IPs (e.g., 192.168.5.10) and filter by HTTP Method GET if the webshell signature typically requires complex POST payloads for execution, as health checks are predominantly GET requests.

• Scenario: Legacy Admin Portal Dynamic Reporting

  • Context: Enterprise administrators using legacy portals (e.g., a custom Oracle ADF or IBM WebSphere dashboard) frequently generate on-demand reports. The portal uses a JSP-based reporting engine that loads specific report definition classes dynamically