Web Shell - file IXRbE.jsp

Hunt Hypothesis

This detection identifies adversaries deploying a malicious JSP web shell named “IXRbE.jsp” to establish a persistent foothold and execute commands on compromised web servers within the Azure environment. Proactive hunting for this specific artifact is critical because web shells often serve as an initial entry point for lateral movement and data exfiltration, allowing attackers to maintain stealthy access even after the initial compromise vector is remediated.

YARA Rule

rule webshell_jsp_IXRbE {
	meta:
		description = "Web Shell - file IXRbE.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "e26e7e0ebc6e7662e1123452a939e2cd"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "<%if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file IXRbE.jsp detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup Script Deployment

  • Context: The enterprise’s nightly backup routine (managed by Veeam Backup & Replication) creates a temporary JSP diagnostic page named IXRbE.jsp within the Tomcat webapps directory to verify connectivity before archiving logs. This file is created and immediately deleted, but the EDR agent captures it during creation as a new suspicious artifact.
  • Suggested Filter: Exclude files matching the pattern IXRbE.jsp where the parent process is vbrservice.exe (Veeam) or java.exe running under the user context svc-backup, and the file age is less than 5 minutes.

• Scenario: DevOps Pipeline Artifact Generation

  • Context: During a CI/CD deployment using Jenkins, the build pipeline generates a temporary staging artifact named IXRbE.jsp as part of a standard “health check” module in the webapps/staging folder. This is a known, static file generated by the jenkins-agent service during the integration phase.
  • Suggested Filter: Create an exclusion for any IXRbE.jsp creation event where the source directory path contains /staging/ and the creating process name matches java.exe with command line arguments containing -Djenkins.agent.

• Scenario: Scheduled System Health Monitoring Job

  • Context: A scheduled Windows Task (Task Scheduler) runs a custom PowerShell script every hour to generate health reports. This script dynamically writes an IXRbE.jsp file into the IIS root directory (C:\inetpub\wwwroot\health) to serve as a temporary status