JSP file writer

Hunt Hypothesis

This detection targets adversaries who create Java Server Pages (JSP) files to establish web shells or execute malicious code on web servers within the Azure environment. Proactively hunting for this behavior is critical because JSP file creation often indicates an initial foothold that could lead to remote command execution and lateral movement if left undetected.

YARA Rule

rule WEBSHELL_JSP_Writer_Nano
{
    meta:
        description = "JSP file writer"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        score = 75
        date = "2021/01/24"
        modified = "2024-12-09"
        hash = "ac91e5b9b9dcd373eaa9360a51aa661481ab9429"
        hash = "c718c885b5d6e29161ee8ea0acadb6e53c556513"
        hash = "9f1df0249a6a491cdd5df598d83307338daa4c43"
        hash = "5e241d9d3a045d3ade7b6ff6af6c57b149fa356e"

        id = "422a18f2-d6d4-5b42-be15-1eafe44e01cf"
    strings:
        // writting file to disk
        $payload1 = ".write" wide ascii
        $payload2 = "getBytes" fullword wide ascii
        $payload3 = ".decodeBuffer" wide ascii
        $payload4 = "FileOutputStream" fullword wide ascii

        // writting using java logging, e.g 9f1df0249a6a491cdd5df598d83307338daa4c43
        $logger1 = "getLogger" fullword ascii wide
        $logger2 = "FileHandler" fullword ascii wide
        $logger3 = "addHandler" fullword ascii wide

        //strings from private rule capa_jsp_input
        // request.getParameter
        $input1 = "getParameter" fullword ascii wide
        // request.getHeaders
        $input2 = "getHeaders" fullword ascii wide
        $input3 = "getInputStream" fullword ascii wide
        $input4 = "getReader" fullword ascii wide
        $req1 = "request" fullword ascii wide
        $req2 = "HttpServletRequest" fullword ascii wide
        $req3 = "getRequest" fullword ascii wide

        $jw_sus1 = /getParameter\("."\)/ ascii wide // one char param
        $jw_sus4 = "yoco" fullword ascii wide // webshell coder

        //strings from private rule capa_jsp_safe
        $cjsp_short1 = "<%" ascii wide
        $cjsp_short2 = "%>" wide ascii
        $cjsp_long1 = "<jsp:" ascii wide
        $cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
        // JSF
        $cjsp_long3 = "/jstl/core" ascii wide
        $cjsp_long4 = "<%@p" nocase ascii wide
        $cjsp_long5 = "<%@ " nocase ascii wide
        $cjsp_long6 = "<% " ascii wide
        $cjsp_long7 = "< %" ascii wide

    condition:
        //any of them or
        (
            any of ( $input* ) and
            any of ( $req* )
        ) and (
            filesize < 200 or
            (
                filesize < 1000 and
                any of ( $jw_sus* )
            )
        )
        and (
        $cjsp_short1 at 0 or
            any of ( $cjsp_long* ) or
            ($cjsp_short1 and $cjsp_short2 in ( filesize-100..filesize )) or
        (
            $cjsp_short2 and (
                $cjsp_short1 in ( 0..1000 ) or
                $cjsp_short1 in ( filesize-1000..filesize )
            )
        )
        )
        and (
            2 of ( $payload* ) or
            all of ( $logger* )
            )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 25 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “JSP file writer” detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scheduled Deployment by CI/CD Pipelines

  • Scenario: Automated build agents (e.g., Jenkins, GitLab Runner, or Azure DevOps) deploy updated web applications to the production server during off-hours. These pipelines frequently write new .jsp files to the Tomcat webapps directory as part of the standard release workflow.
  • Filter/Exclusion: Create a whitelist exclusion for the specific service account used by the CI/CD tool (e.g., svc-jenkins-deploy) and restrict the scope to the deployment window (e.g., 01:00–04:00 UTC).

• Application Server Auto-Configuration

  • Scenario: The Java Application Server (such as Apache Tomcat, IBM WebSphere, or JBoss EAP) automatically generates temporary JSP files during runtime initialization or when a new module is loaded. This often occurs after a server restart triggered by the Operations team.
  • Filter/Exclusion: Exclude events where the source process name matches the application server executable (e.g., java.exe running under the tomcat user) and the file path contains standard runtime directories like /temp or /work.

• Backup and Archiving Solutions

  • Scenario: Enterprise backup agents (e.g., Veeam, Commvault, or Rubrik) perform incremental backups of the web server’s content directory. During this process, the agent may create temporary JSP manifests or index files to track changes before archiving.
  • Filter/Exclusion: Filter out events where the parent process is a known backup service (e.g., vss.exe for Veeam) and the file