Web Shell - file hsxa.jsp

Hunt Hypothesis

This detection identifies adversaries deploying a malicious web shell named hsxa.jsp to establish persistent access and execute commands on compromised web servers within the Azure environment. Proactive hunting for this specific artifact is critical because web shells often serve as initial footholds that enable attackers to pivot laterally, exfiltrate sensitive data, or maintain long-term stealthy presence before triggering broader alerts.

YARA Rule

rule webshell_jsp_hsxa {
	meta:
		description = "Web Shell - file hsxa.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "d0e05f9c9b8e0b3fa11f57d9ab800380"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%><jsp:directive.page import=\"ja"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file hsxa.jsp detection rule, along with targeted filters and exclusions:

• Scenario: Automated Deployment via CI/CD Pipeline

  • Context: The DevOps team uses Jenkins or GitLab CI to deploy new microservices. During a nightly build, the pipeline deploys a standard utility file named hsxa.jsp (part of a legacy library) to the Tomcat web container (/webapps/ROOT).
  • Filter/Exclusion: Create an exclusion based on the Source Host and User Identity. Exclude alerts where the source IP belongs to the CI/CD server subnet (e.g., 10.20.50.x) or where the modifying user is a service account like svc-deploy or jenkins-bot.

• Scenario: Scheduled Maintenance by System Administrator

  • Context: A system administrator runs a weekly maintenance script using PowerShell to update configuration files on the application server. The script explicitly copies a helper JSP file named hsxa.jsp into the web root directory at 2:00 AM on Sundays.
  • Filter/Exclusion: Implement a time-based and process-based filter. Exclude events occurring between Sunday 01:00 and 03:00 where the parent process is powershell.exe or cmd.exe executed by an admin account (e.g., DOMAIN\AdminGroup).

• Scenario: Third-Party Monitoring Agent Installation

  • Context: The enterprise uses Dynatrace or New Relic for application performance monitoring. Upon initial agent installation or a major version upgrade, the agent automatically deploys a diagnostic JSP file named hsxa.jsp to the web container to facilitate health checks and metric