Webshell JSP HTTP proxy

Hunt Hypothesis

This detection identifies adversaries who have deployed a Java Server Pages (JSP) webshell to establish an HTTP proxy for command and control or lateral movement within the application layer. The SOC team should proactively hunt for this activity in Azure Sentinel because JSP webshells often evade traditional file integrity monitoring, requiring behavioral analysis of HTTP traffic patterns to uncover persistent backdoors that could lead to data exfiltration.

YARA Rule

rule WEBSHELL_JSP_HTTP_Proxy
{
    meta:
        description = "Webshell JSP HTTP proxy"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        hash = "2f9b647660923c5262636a5344e2665512a947a4"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        score = 75
        date = "2021/01/24"
        modified = "2024-12-09"
        hash = "97c1e2bf7e769d3fc94ae2fc74ac895f669102c6"
        hash = "2f9b647660923c5262636a5344e2665512a947a4"

        id = "55be246e-30a8-52ed-bc5f-507e63bbfe16"
    strings:
        $jh1 = "OutputStream" fullword wide ascii
        $jh2 = "InputStream"  wide ascii
        $jh3 = "BufferedReader" fullword wide ascii
        $jh4 = "HttpRequest" fullword wide ascii
        $jh5 = "openConnection" fullword wide ascii
        $jh6 = "getParameter" fullword wide ascii

        //strings from private rule capa_jsp_safe
        $cjsp_short1 = "<%" ascii wide
        $cjsp_short2 = "%>" wide ascii
        $cjsp_long1 = "<jsp:" ascii wide
        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
        // JSF
        $cjsp_long3 = "/jstl/core" ascii wide
        $cjsp_long4 = "<%@p" nocase ascii wide
        $cjsp_long5 = "<%@ " nocase ascii wide
        $cjsp_long6 = "<% " ascii wide
        $cjsp_long7 = "< %" ascii wide

    condition:
        filesize < 10KB and (
        $cjsp_short1 at 0 or
            any of ( $cjsp_long* ) or
            ($cjsp_short1 and $cjsp_short2 in ( filesize-100..filesize )) or
        (
            $cjsp_short2 and (
                $cjsp_short1 in ( 0..1000 ) or
                $cjsp_short1 in ( filesize-1000..filesize )
            )
        )
        )
        and all of ( $jh* )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 15 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Webshell JSP HTTP proxy detection rule, including targeted filters and exclusions:

• Scenario: Scheduled Backup of JSP Application Artifacts

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) or internal maintenance scripts often perform nightly backups by reading .jsp files directly from the web server directory. These tools may open HTTP connections to the application server to verify file integrity or trigger a “warm-up” request, which can mimic the traffic pattern of a JSP webshell proxying data.
  • Filter/Exclusion: Create an exclusion rule based on the source IP address of the backup servers (e.g., 10.50.20.x) and restrict the detection to specific time windows outside of maintenance hours (e.g., exclude traffic between 02:00–04:00 UTC).

• Scenario: CI/CD Pipeline Deployment Artifacts

  • Context: During automated deployments using tools like Jenkins, GitLab CI, or Azure DevOps, the pipeline often deploys new .jsp files to the Tomcat/JBoss container. The deployment agent may execute a health check by sending an HTTP POST request containing JSP payload data to verify the deployment success, triggering the proxy detection logic.
  • Filter/Exclusion: Exclude traffic originating from the CI/CD controller IP range (e.g., 192.168.50.x) and filter out requests where the User-Agent header contains specific identifiers like Jenkins, GitLab Runner, or Azure-DevOps.

• Scenario: Legitimate Admin Portal Health Checks

  • Context: Internal monitoring platforms such as Datadog, New Relic, or SolarWinds frequently