Generic JSP webshell which uses processbuilder to execute user input

Hunt Hypothesis

This detection identifies a generic Java Server Pages (JSP) webshell that leverages ProcessBuilder to dynamically execute untrusted user input, indicating potential remote code execution by an adversary. SOC teams should proactively hunt for this behavior in Azure Sentinel because such webshells often serve as persistent backdoors that can escalate privileges and orchestrate lateral movement across the environment.

YARA Rule

rule WEBSHELL_JSP_Generic_ProcessBuilder
{
    meta:
        description = "Generic JSP webshell which uses processbuilder to execute user input"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        score = 75
        date = "2021/01/07"
        modified = "2023-04-05"
        hash = "82198670ac2072cd5c2853d59dcd0f8dfcc28923"
        hash = "c05a520d96e4ebf9eb5c73fc0fa446ceb5caf343"
        hash = "347a55c174ee39ec912d9107e971d740f3208d53af43ea480f502d177106bbe8"
        hash = "d0ba29b646274e8cda5be1b940a38d248880d9e2bba11d994d4392c80d6b65bd"

        id = "2a7c5f44-24a1-5f43-996e-945c209b79b1"
    strings:
        $exec = "ProcessBuilder" fullword wide ascii
        $start = "start" fullword wide ascii

        //strings from private rule capa_jsp_input
        // request.getParameter
        $input1 = "getParameter" fullword ascii wide
        // request.getHeaders
        $input2 = "getHeaders" fullword ascii wide
        $input3 = "getInputStream" fullword ascii wide
        $input4 = "getReader" fullword ascii wide
        $req1 = "request" fullword ascii wide
        $req2 = "HttpServletRequest" fullword ascii wide
        $req3 = "getRequest" fullword ascii wide

    condition:
        filesize < 2000 and (
            any of ( $input* ) and
            any of ( $req* )
        )
        and $exec and $start
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Generic JSP webshell using ProcessBuilder” detection rule, along with suggested filters and exclusions:

• Scheduled Backup Script Execution

  • Scenario: An automated nightly backup job hosted on a Tomcat server runs a custom .jsp utility that invokes ProcessBuilder to call external tools like rsync, tar, or aws-cli for data archival. The script dynamically constructs command strings based on the current date and environment variables, which mimics user input execution.
  • Filter/Exclusion: Create a whitelist exclusion for the specific JSP file path (e.g., /backup/scheduled-backup.jsp) combined with the known parent process ID (PID) of the backup scheduler service. Additionally, filter out commands that match a regex pattern for known backup tools: ^(rsync|tar|aws-cli|xcopy)[\s\S]*$.

• Admin Dashboard Deployment Tool

  • Scenario: The DevOps team utilizes an internal “Deployment Manager” web portal (built on JSP) where administrators manually trigger deployment scripts. When a user clicks “Deploy,” the backend executes ProcessBuilder to run kubectl apply, docker build, or git pull commands using parameters passed from the UI form.
  • Filter/Exclusion: Exclude events originating from the specific IP range of the DevOps management subnet (e.g., 10.20.45.0/24). Furthermore, add a filter to ignore executions where the command string contains standard deployment keywords like kubectl, docker, or git and is initiated by service accounts named svc-deploy-admin.

• Log Aggregation and Analysis Service

  • Scenario: A centralized logging service runs a JSP-based analyzer that periodically parses raw logs. To handle complex log rotation or