Generic JSP webshell which contains cmd or /bin/bash encoded in ascii ord

Hunt Hypothesis

This detection identifies malicious Java Server Pages (JSP) webshells that execute system commands by encoding “cmd” or “/bin/bash” into ASCII ordinal values to evade signature-based scanning. Proactively hunting for this behavior in Azure Sentinel is critical because these obfuscated webshells often serve as the initial foothold for adversaries to establish persistence and gain remote command execution capabilities on compromised application servers.

YARA Rule

rule WEBSHELL_JSP_Generic_Encoded_Shell
{
    meta:
        description = "Generic JSP webshell which contains cmd or /bin/bash encoded in ascii ord"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        score = 75
        date = "2021/01/07"
        modified = "2023-07-05"
        hash = "3eecc354390d60878afaa67a20b0802ce5805f3a9bb34e74dd8c363e3ca0ea5c"
        hash = "f6c2112e3a25ec610b517ff481675b2ce893cb9f"
        hash = "62e6c6065b5ca45819c1fc049518c81d7d165744"

        id = "359949d7-1793-5e13-9fdc-fe995ae12117"
    strings:
        $sj0 = /\{ ?47, 98, 105, 110, 47, 98, 97, 115, 104/ wide ascii
        $sj1 = /\{ ?99, 109, 100}/ wide ascii
        $sj2 = /\{ ?99, 109, 100, 46, 101, 120, 101/ wide ascii
        $sj3 = /\{ ?47, 98, 105, 110, 47, 98, 97/ wide ascii
        $sj4 = /\{ ?106, 97, 118, 97, 46, 108, 97, 110/ wide ascii
        $sj5 = /\{ ?101, 120, 101, 99 }/ wide ascii
        $sj6 = /\{ ?103, 101, 116, 82, 117, 110/ wide ascii

    condition:
        filesize <300KB and any of ($sj*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Generic JSP webshell containing cmd or /bin/bash encoded in ASCII ord” detection rule, along with suggested filters:

• Scheduled Backup Jobs via Java Agents

  • Scenario: Enterprise backup solutions (e.g., Veeam, Commvault) often deploy Java-based agents that execute scheduled maintenance scripts. These agents frequently invoke system shells (cmd.exe on Windows or /bin/bash on Linux) to compress logs or rotate files using a JSP wrapper for reporting. The agent’s internal logic encodes the shell command path as ASCII ordinal values (e.g., 109 99 100) within the JSP payload, triggering the rule despite being a standard operational task.
  • Suggested Filter: Exclude traffic originating from known backup service IP ranges or specific hostnames containing keywords like “Veeam”, “Commvault”, or “BackupAgent”. Additionally, filter out requests where the User-Agent header contains the vendor’s signature string (e.g., User-Agent: Veeam-Backup-Java/12.0).

• CI/CD Pipeline Deployment Artifacts

  • Scenario: During automated deployment cycles using tools like Jenkins or GitLab CI, a JSP-based deployment dashboard is often instantiated to visualize build status. The pipeline orchestrator injects a temporary JSP script that executes shell commands to verify container health or pull environment variables. This process involves encoding cmd or /bin/bash paths into the JSP source code using ASCII ordinals to ensure cross-platform compatibility during the artifact generation phase.
  • Suggested Filter: Create an exclusion for traffic occurring within a defined maintenance window (e.g., 02:00–04:00 UTC) from CI/CD server subnets. Alternatively, filter based on the presence of specific HTTP headers indicating