Web Shell - file k8cmd.jsp

Hunt Hypothesis

This rule detects adversaries deploying a malicious JSP web shell named k8cmd.jsp to establish persistent access and execute arbitrary commands on compromised web servers. Proactive hunting for this artifact in Azure Sentinel is critical because such shells often serve as an initial foothold for lateral movement and data exfiltration, allowing attackers to operate stealthily within the environment before triggering broader alerts.

YARA Rule

rule webshell_jsp_k8cmd {
	meta:
		description = "Web Shell - file k8cmd.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "b39544415e692a567455ff033a97a682"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s2 = "if(request.getSession().getAttribute(\"hehe\").toString().equals(\"hehe\"))" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file k8cmd.jsp detection rule, including targeted filters and exclusions:

• Kubernetes Dashboard Deployment: The k8cmd.jsp file is a standard component of the official Kubernetes Dashboard or similar management portals (e.g., Rancher, OpenShift) deployed in the enterprise namespace. When administrators access the dashboard to manage pods or view logs, the presence of this file triggers the rule even though it is part of the baseline application architecture.

  • Filter/Exclusion: Exclude files located within known Kubernetes management namespaces (e.g., kubernetes-dashboard, rancher-system) and restrict alerts to only trigger if the file hash changes or if the file size exceeds a defined threshold (e.g., >50KB) indicating potential modification.

• Scheduled CI/CD Pipeline Execution: Automated deployment pipelines using tools like Jenkins, GitLab CI, or Azure DevOps periodically deploy updated versions of the Kubernetes management interface during maintenance windows. The k8cmd.jsp file is recreated or updated as part of this routine workflow, mimicking a web shell creation event.

  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00–04:00 UTC) for deployments originating from known CI/CD service accounts or IP ranges associated with the build cluster. Additionally, correlate alerts with deployment logs to suppress notifications when a kubectl apply event is detected on the same host within a 5-minute window.

• Third-Party Monitoring Agent Installation: Enterprise monitoring solutions such as Datadog, New Relic, or Dynatrace often install custom JSP agents or sidecar containers that include utility files named k8cmd.jsp to facilitate cluster command execution and metric collection. These are legitimate artifacts installed by the observability team.

  • **Filter/Ex