Web Shell - file k81.jsp

Hunt Hypothesis

This detection targets adversaries who deploy a malicious web shell named k1.jsp to establish persistence and execute commands on compromised web servers within the Azure Sentinel environment. Proactive hunting for this specific artifact is critical because web shells often serve as an initial foothold for attackers, enabling them to move laterally across the network and exfiltrate sensitive data before traditional alerts are triggered.

YARA Rule

rule webshell_jsp_k81 {
	meta:
		description = "Web Shell - file k81.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "41efc5c71b6885add9c1d516371bd6af"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "byte[] binary = BASE64Decoder.class.newInstance().decodeBuffer(cmd);" fullword
		$s9 = "if(cmd.equals(\"Szh0ZWFt\")){out.print(\"[S]\"+dir+\"[E]\");}" fullword
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file k81.jsp detection rule, tailored for an enterprise environment:

• Scheduled Backup Script Execution

  • Scenario: The enterprise backup solution (e.g., Veeam or Commvault) runs a nightly maintenance job that temporarily deploys k81.jsp as part of its reporting module on the Tomcat server to generate daily health dashboards. This file is created, executed, and then archived by the backup agent, mimicking the behavior of a web shell upload.
  • Filter/Exclusion: Exclude alerts where the source IP belongs to the dedicated Backup Server subnet (e.g., 10.50.20.0/24) or where the user account is the service principal svc_backup_agent during the scheduled maintenance window (e.g., 02:00–04:00 UTC).

• CI/CD Pipeline Deployment

  • Scenario: The DevOps team utilizes Jenkins or GitLab CI to automate application updates. During a standard deployment of the “Customer Portal” microservice, the pipeline explicitly uploads k81.jsp as a known component of the new release package to the staging environment’s Tomcat instance before promoting it to production.
  • Filter/Exclusion: Create an exclusion rule for file creation events originating from the CI/CD Controller IP (e.g., 192.168.50.10) where the action is triggered by the service account ci-deploy-bot, specifically when the deployment status in the pipeline logs indicates “Success.”

• Third-Party Monitoring Agent Installation

  • Scenario: The IT operations team deploys a new monitoring agent (e.g., Dynatrace OneAgent or