JSP uploader which gets input, writes files and contains \

Hunt Hypothesis

This detection identifies potential web shell deployments where adversaries exploit Java Server Pages (JSP) uploaders to write malicious files containing backslash characters, a common indicator of file path manipulation or command injection attacks. Proactively hunting for this behavior in Azure Sentinel is critical because successful exploitation often grants attackers persistent access and the ability to execute arbitrary commands on the host system before traditional alerts trigger.

YARA Rule

rule WEBSHELL_JSP_Input_Upload_Write
{
    meta:
        description = "JSP uploader which gets input, writes files and contains \"upload\""
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        score = 75
        date = "2021/01/24"
        modified = "2024-12-09"
        hash = "ef98ca135dfb9dcdd2f730b18e883adf50c4ab82"
        hash = "583231786bc1d0ecca7d8d2b083804736a3f0a32"
        hash = "19eca79163259d80375ebebbc440b9545163e6a3"

        id = "bbf26edd-88b7-5ec5-a16e-d96a086dcd19"
    strings:
        $upload = "upload" nocase wide ascii
        $write1 = "os.write" fullword wide ascii
        $write2 = "FileOutputStream" fullword wide ascii

        //strings from private rule capa_jsp_safe
        $cjsp_short1 = "<%" ascii wide
        $cjsp_short2 = "%>" wide ascii
        $cjsp_long1 = "<jsp:" ascii wide
        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
        // JSF
        $cjsp_long3 = "/jstl/core" ascii wide
        $cjsp_long4 = "<%@p" nocase ascii wide
        $cjsp_long5 = "<%@ " nocase ascii wide
        $cjsp_long6 = "<% " ascii wide
        $cjsp_long7 = "< %" ascii wide

        //strings from private rule capa_jsp_input
        // request.getParameter
        $input1 = "getParameter" fullword ascii wide
        // request.getHeaders
        $input2 = "getHeaders" fullword ascii wide
        $input3 = "getInputStream" fullword ascii wide
        $input4 = "getReader" fullword ascii wide
        $req1 = "request" fullword ascii wide
        $req2 = "HttpServletRequest" fullword ascii wide
        $req3 = "getRequest" fullword ascii wide

    condition:
        filesize < 10KB and (
        $cjsp_short1 at 0 or
            any of ( $cjsp_long* ) or
            ($cjsp_short1 and $cjsp_short2 in ( filesize-100..filesize )) or
        (
            $cjsp_short2 and (
                $cjsp_short1 in ( 0..1000 ) or
                $cjsp_short1 in ( filesize-1000..filesize )
            )
        )
        )
        and (
            any of ( $input* ) and
            any of ( $req* )
        )
        and $upload and 1 of ( $write* )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 19 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the “JSP Uploader with Backslash Input” detection rule, including suggested filters or exclusions:

• Scenario: Legacy Enterprise Document Management System (DMS) Batch Ingestion

  • Context: The organization uses a legacy DMS (e.g., Alfresco or Nuxeo) running on a Tomcat server. During nightly maintenance, the system ingests thousands of documents from network shares where file paths contain Windows-style backslashes (e.g., C:\Users\Uploads\2023\Q4\Report.pdf). The JSP upload handler processes these paths as part of the filename or metadata string, triggering the rule due to the presence of \ characters in the input stream.
  • Filter/Exclusion: Create an exclusion for the specific host IP range of the DMS server and filter out events where the User-Agent header matches the internal batch job identifier (e.g., Alfresco-Batch-Service).

• Scenario: Automated Backup Script via Web Interface

  • Context: An automated backup agent (such as Veeam or a custom Python script using requests library) periodically triggers file uploads through the JSP portal to archive logs. The script constructs the destination path dynamically, often including backslashes in the filename parameter when writing to Windows-based storage volumes mapped via the web interface.
  • Filter/Exclusion: Exclude traffic originating from the dedicated backup service account (e.g., svc_backup_agent) and filter events where the request method is POST with a specific custom header (e.g., X-Script-Automated: true).

• Scenario: HR Portal Employee Onboarding Workflow

  • Context: The internal HR portal (built on Liferay or **Jira Service Management