Web Shell - file utils.jsp

Hunt Hypothesis

This hunt hypothesis targets adversaries who have established a persistent foothold by deploying a utils.jsp web shell to manipulate files and execute commands on the server. Proactively hunting for this specific artifact in Azure Sentinel is critical because JSP-based shells often evade standard network monitoring, allowing attackers to maintain stealthy access and escalate privileges within the environment.

YARA Rule

rule webshell_jsp_utils {
	meta:
		description = "Web Shell - file utils.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "9827ba2e8329075358b8e8a53e20d545"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "ResultSet r = c.getMetaData().getTables(null, null, \"%\", t);" fullword
		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file utils.jsp detection rule, including suggested filters or exclusions:

• DevOps Deployment of Utility Scripts: During routine application deployments via CI/CD pipelines (e.g., Jenkins or GitLab CI), automation scripts often upload a temporary utils.jsp to the Tomcat webapps directory to perform post-deployment file cleanup or configuration synchronization.

  • Filter/Exclusion: Exclude alerts where the source IP belongs to the internal CI/CD subnet and the user agent matches known deployment tools (e.g., Jenkins, GitLab Runner). Additionally, filter out files with a modification timestamp matching the current deployment window.

• Scheduled Maintenance Jobs by Admin Accounts: System administrators frequently use scheduled tasks (via Windows Task Scheduler or cron jobs) to run diagnostic scripts that temporarily instantiate utils.jsp for log rotation and disk usage reporting on the web server.

  • Filter/Exclusion: Create an exclusion rule for files created by specific service accounts (e.g., svc_webadmin, tomcat_user) during defined maintenance windows (e.g., Sundays 02:00–04:00 UTC). Verify that the file hash matches a known “golden” baseline of the utility script.

• Third-Party Application Updates: Enterprise resource planning (ERP) or customer relationship management (CRM) systems (such as SAP NetWeaver or Salesforce Commerce Cloud) often include utils.jsp as part of their standard module update packages to handle file attachments and server-side processing.

  • Filter/Exclusion: Whitelist the specific directory paths associated with these third-party applications (e.g., /opt/sap/webapps/erp_utils/) and exclude alerts where the file size falls within the expected range for known vendor updates.

• Legacy Reporting Module Activation: Business Intelligence teams may activate a legacy reporting