Web Shell - file guige.jsp

Hunt Hypothesis

This detection identifies adversaries deploying a malicious web shell named guige.jsp to establish a persistent foothold and execute commands on compromised web servers within the Azure environment. Proactively hunting for this specific file is critical because web shells often serve as the initial entry point for lateral movement and data exfiltration, requiring immediate investigation before attackers can expand their access or hide deeper in the infrastructure.

YARA Rule

rule webshell_jsp_guige {
	meta:
		description = "Web Shell - file guige.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "2c9f2dafa06332957127e2c713aacdd2"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "if(damapath!=null &&!damapath.equals(\"\")&&content!=null"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file guige.jsp detection rule, including suggested filters and exclusions:

• Scheduled Backup or Reporting Job by Enterprise Monitoring Tools

  • Scenario: Automated backup agents (e.g., Veeam, Commvault) or reporting suites (e.g., Splunk Universal Forwarder, SolarWinds) often deploy temporary JSP files to the web root for status dashboards or log aggregation. A job named guige.jsp might be a legacy component of a custom internal reporting module that runs nightly via Windows Task Scheduler or Cron.
  • Filter/Exclusion: Exclude file creation events where the parent process is a known monitoring service (e.g., vssvc.exe, splunkd.exe) and the file path resides within a dedicated reporting directory (e.g., /reports/dashboards/).

• Deployment of Internal Admin Portals by DevOps Pipelines

  • Scenario: During routine CI/CD deployments using tools like Jenkins, GitLab Runner, or Azure DevOps, the pipeline may deploy a utility JSP named guige.jsp as part of an internal administration module (e.g., “Guige” could be an acronym for a specific governance tool). This file is created by the deployment agent rather than user interaction.
  • Filter/Exclusion: Create an exclusion rule based on the source IP address belonging to the CI/CD server range and the process name matching the deployment agent (e.g., jenkins-agent.exe, java running under a specific service account like svc-deploy).

• Legacy Application Maintenance by System Administrators

  • Scenario: A system administrator manually updates or patches an older Java-based application using IntelliJ IDEA, Eclipse, or **