Web Shell - file tree.jsp

Hunt Hypothesis

This detection identifies adversaries deploying a tree.jsp web shell to establish persistent access and execute commands on compromised web servers within the Azure Sentinel environment. Proactive hunting for this specific artifact is critical because web shells often serve as an initial foothold for lateral movement and data exfiltration, requiring immediate investigation before attackers can expand their presence undetected.

YARA Rule

rule webshell_jsp_tree {
	meta:
		description = "Web Shell - file tree.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "bcdf7bbf7bbfa1ffa4f9a21957dbcdfa"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s5 = "$('#tt2').tree('options').url = \"selectChild.action?checki"
		$s6 = "String basePath = request.getScheme()+\"://\"+request.getServerName()+\":\"+requ"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file tree.jsp detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup and Migration Scripts

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) or migration tools often deploy a generic tree.jsp utility to visualize directory structures during pre-migration checks. These scripts may dynamically generate the file in temporary directories rather than the main web root, mimicking a manual upload of a new shell.
  • Filter/Exclusion: Exclude alerts where the source IP belongs to the Backup Server Group (e.g., 10.20.30.x) AND the destination path contains keywords like /temp/, /staging/, or /backup_staging/. Additionally, filter out events where the HTTP User-Agent string matches known backup tool signatures (e.g., Veeam-Backup-Agent).

• Scenario: Scheduled Health Monitoring and Diagnostics

  • Context: Internal monitoring platforms like Splunk, Datadog, or custom Ansible/AWS Lambda jobs frequently execute diagnostic scripts that include a tree.jsp component to audit file permissions and directory depth. These are often triggered by cron jobs running during off-hours (e.g., 02:00–04:00 UTC) from the internal monitoring subnet.
  • Filter/Exclusion: Create an exclusion rule for events occurring within the Monitoring Subnet (192.168.50.x) where the HTTP status code is 200 OK and the file modification timestamp aligns with known maintenance windows (e.g., weekdays between 02:00 and 04:00).

• Scenario: DevOps CI/CD Pipeline Artifacts

  ---