Web Shell - file guige02.jsp

Hunt Hypothesis

This detection identifies adversaries establishing a persistent web shell named guige02.jsp to execute arbitrary commands and maintain access within Azure-hosted web applications. A proactive hunt is essential because web shells often serve as an initial foothold for lateral movement and data exfiltration, requiring immediate investigation before attackers can expand their presence across the environment.

YARA Rule

rule webshell_jsp_guige02 {
	meta:
		description = "Web Shell - file guige02.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "a3b8b2280c56eaab777d633535baf21d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "????????????????%><html><head><title>hahahaha</title></head><body bgcolor=\"#fff"
		$s1 = "<%@page contentType=\"text/html; charset=GBK\" import=\"java.io.*;\"%><%!private"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file guige02.jsp detection rule, including tailored filters and exclusions:

Scheduled Backup or Reporting Job: An automated nightly job (e.g., running via Windows Task Scheduler or a Cron task on Linux) executes a custom reporting script that dynamically generates a temporary JSP file named guige02.jsp in the web root to aggregate daily logs before archiving them.
- Suggested Filter: Exclude alerts where the process name is java.exe (or specific service account like svc_backup) and the parent process is svchost.exe or cron, occurring strictly between 01:00 and 04:00 local time.
DevOps Deployment Pipeline: A CI/CD pipeline using Jenkins or Azure DevOps deploys a patch to the application server, which includes the deployment of a standard utility file guige02.jsp as part of a routine update package for the “Guige” module.
- Suggested Filter: Create an exclusion based on the source IP address belonging to the internal CI/CD subnet (e.g., 10.50.40.x) and filter events where the user context is the deployment service account (e.g., svc_ci_cd).
Legacy Application Maintenance by Admin: A system administrator manually uploads a diagnostic tool named guige02.jsp to the Tomcat web container via FileZilla or SCP to troubleshoot a specific customer issue, creating the file directly in the /webapps/ROOT directory.
- Suggested Filter: Exclude events where the file creation timestamp aligns with an active ITSM ticket (e.g., Jira ticket ID containing “MAINT”) and the source user is a member of