Webshell regeorg JSP version

Hunt Hypothesis

This detection identifies adversaries deploying Regorge webshells in Java Server Pages (JSP) to establish persistent command-and-control channels and execute arbitrary code on compromised web servers. Proactive hunting for this specific artifact is critical within Azure Sentinel to rapidly identify early-stage post-exploitation activities before attackers can leverage the webshell for lateral movement or data exfiltration.

YARA Rule

rule WEBSHELL_JSP_ReGeorg
{
    meta:
        description = "Webshell regeorg JSP version"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        reference = "https://github.com/sensepost/reGeorg"
        hash = "6db49e43722080b5cd5f07e058a073ba5248b584"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2021/01/24"
        modified = "2024-12-09"
        score = 75
        hash = "650eaa21f4031d7da591ebb68e9fc5ce5c860689"
        hash = "00c86bf6ce026ccfaac955840d18391fbff5c933"
        hash = "6db49e43722080b5cd5f07e058a073ba5248b584"
        hash = "9108a33058aa9a2fb6118b719c5b1318f33f0989"

        id = "cbb90005-d8f8-5c64-85d1-29e466f48c25"
    strings:
        $jgeorg1 = "request" fullword wide ascii
        $jgeorg2 = "getHeader" fullword wide ascii
        $jgeorg3 = "X-CMD" fullword wide ascii
        $jgeorg4 = "X-STATUS" fullword wide ascii
        $jgeorg5 = "socket" fullword wide ascii
        $jgeorg6 = "FORWARD" fullword wide ascii

        //strings from private rule capa_jsp_safe
        $cjsp_short1 = "<%" ascii wide
        $cjsp_short2 = "%>" wide ascii
        $cjsp_long1 = "<jsp:" ascii wide
        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
        // JSF
        $cjsp_long3 = "/jstl/core" ascii wide
        $cjsp_long4 = "<%@p" nocase ascii wide
        $cjsp_long5 = "<%@ " nocase ascii wide
        $cjsp_long6 = "<% " ascii wide
        $cjsp_long7 = "< %" ascii wide

    condition:
        filesize < 300KB and (
        $cjsp_short1 at 0 or
            any of ( $cjsp_long* ) or
            ($cjsp_short1 and $cjsp_short2 in ( filesize-100..filesize )) or
        (
            $cjsp_short2 and (
                $cjsp_short1 in ( 0..1000 ) or
                $cjsp_short1 in ( filesize-1000..filesize )
            )
        )
        )
        and all of ( $jgeorg* )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 15 string patterns in its detection logic.

References

• https://github.com/sensepost/reGeorg
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Webshell regeorg JSP version detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup or Migration Scripts Executing via Jenkins/GitLab CI

  • Context: DevOps pipelines often deploy temporary JSP scripts to handle data migration or backup tasks. These scripts may dynamically generate Java bytecode that mimics the obfuscation patterns of the Regorg webshell, particularly when using reflection to load classes.
  • Filter/Exclusion: Exclude HTTP requests originating from internal CI/CD service accounts (e.g., jenkins-agent, gitlab-runner) or restrict the rule to exclude traffic where the User-Agent header contains specific pipeline identifiers (e.g., Jenkins/2.x).

• Scenario: Scheduled Health Checks by Enterprise Monitoring Tools

  • Context: Tools like SolarWinds, Datadog, or Nagios perform frequent health checks on JSP endpoints. These tools often send complex payloads to verify application responsiveness, which can trigger the Regorg signature if the tool uses a Java-based agent that executes similar bytecode structures during its probing logic.
  • Filter/Exclusion: Create an exclusion list for known monitoring IP ranges (e.g., 10.50.x.x) or filter out requests where the HTTP Method is GET and the response code is 200, as Regorg webshells often utilize POST with complex payloads for command execution.

• Scenario: Admin Maintenance Tasks Using JConsole or VisualVM

  • Context: System administrators frequently use Java monitoring tools like JConsole, VisualVM, or IBM Tivoli to analyze server performance. When these tools interact with the application server’s management console (often a JSP interface), they may inject diagnostic scripts that resemble the Reg