Web Shell - file web.jsp

Hunt Hypothesis

This detection identifies adversaries deploying a web.jsp web shell to establish persistent access and execute commands on compromised web servers within the Azure Sentinel environment. Proactive hunting for this artifact is critical because JSP shells are frequently used as an initial foothold for lateral movement, data exfiltration, or remote command execution that may evade standard signature-based defenses.

YARA Rule

rule webshell_jsp_web {
	meta:
		description = "Web Shell - file web.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "4bc11e28f5dccd0c45a37f2b541b2e98"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "<%@page import=\"java.io.*\"%><%@page import=\"java.net.*\"%><%String t=request."
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file web.jsp detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Deployment via CI/CD Pipeline

  • Context: The DevOps team uses Jenkins or GitLab CI to deploy new application updates. During the build phase, the pipeline deploys a standard web.jsp file (often containing health check logic) to the Tomcat server’s webapps directory as part of the routine release process.
  • Filter/Exclusion: Exclude events where the source user is the CI service account (e.g., svc-jenkins-deploy) and the source IP belongs to the internal build network range (e.g., 10.50.x.x). Additionally, filter out files created during the standard deployment window (e.g., 02:00–04:00 UTC).

• Scenario: Scheduled Health Check by Monitoring Tool

  • Context: The enterprise monitoring solution, such as Datadog Agent or Nagios, periodically executes a synthetic transaction that writes a temporary web.jsp file to verify the web server’s responsiveness and database connectivity. This occurs every 5 minutes across all production nodes.
  • Filter/Exclusion: Create an exclusion rule based on the specific file path (e.g., /opt/tomcat/webapps/monitoring/status.web.jsp) and the source process name (datadog-agent or nagios-check). Exclude events where the file size remains constant (indicating a re-write of identical content) rather than a new creation.

• Scenario: Administrator Manual Configuration via SSH

  • Context: A System Administrator logs into the server via SSH using their corporate account to manually patch a configuration issue or add a