Web Shell - file list1.jsp

Hunt Hypothesis

This detection rule identifies adversaries deploying a “list1.jsp” web shell to establish persistent access and execute commands on compromised web servers within the Azure Sentinel environment. Proactively hunting for this specific artifact is critical because its generic filename often evades standard signature-based detections, allowing attackers to maintain stealthy command-and-control channels that could lead to lateral movement or data exfiltration if left unaddressed.

YARA Rule

rule webshell_jsp_list1 {
	meta:
		description = "Web Shell - file list1.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "8d9e5afa77303c9c01ff34ea4e7f6ca6"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s1 = "case 's':ConnectionDBM(out,encodeChange(request.getParameter(\"drive"
		$s9 = "return \"<a href=\\\"javascript:delFile('\"+folderReplace(file)+\"')\\\""
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file list1.jsp detection rule, including targeted filters and exclusions:

• Scheduled Backup Report Generation

  • Scenario: The enterprise backup solution (e.g., Veeam or Commvault) runs a nightly job that generates a summary report named list1.jsp in the web root directory to display backup status on an internal dashboard. This file is created by the backup service account rather than user interaction.
  • Filter/Exclusion: Exclude files where the creator process name matches Veeam.Backup.Service.exe or commvault.cmd and the source IP belongs to the dedicated backup subnet (e.g., 10.20.x.x).

• CI/CD Pipeline Deployment Artifacts

  • Scenario: During a routine application deployment via Jenkins or GitLab CI, the pipeline deploys a standard utility page named list1.jsp as part of the initial build artifact for the new version of the inventory management module. This is an expected, automated file creation event.
  • Filter/Exclusion: Create an exclusion rule that ignores events occurring within 30 minutes of a successful pipeline completion webhook from Jenkins (Jenkins-Agent-01) or GitLab Runner, specifically targeting files with a modification timestamp matching the deployment window.

• Automated Health Check Script Execution

  • Scenario: A custom Python script running via a Windows Task Scheduler (or Linux Cron) performs hourly health checks on the web server. As part of this routine, it dynamically generates list1.jsp to log current service availability metrics for internal monitoring tools like SolarWinds or Datadog.
  • Filter/Exclusion: Filter out events where the user context is a known service account (e.g., NT SERVICE\HealthCheckAgent) and the file hash