Web Shell - file zx.jsp

Hunt Hypothesis

This detection identifies adversaries deploying a malicious zx.jsp web shell to establish persistent access and execute commands on compromised web servers. Proactive hunting for this artifact in Azure Sentinel is critical because web shells often serve as an initial foothold for lateral movement and data exfiltration, requiring immediate investigation before the attacker can deepen their presence.

YARA Rule

rule webshell_jsp_zx {
	meta:
		description = "Web Shell - file zx.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "67627c264db1e54a4720bd6a64721674"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application.g"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file zx.jsp detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Backup Script Execution

  • Context: The enterprise backup solution (e.g., Veeam Backup & Replication or Commvault) generates a temporary zx.jsp file within the web server’s deployment directory to log status during nightly maintenance windows. This file is created by the service account running the backup agent, not an external attacker.
  • Filter/Exclusion: Create an exclusion rule that ignores alerts where the Source User matches the known backup service account (e.g., svc_backup_agent) and the File Creation Time falls within the scheduled maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: CI/CD Pipeline Deployment Artifacts

  • Context: During a routine deployment via Jenkins or Azure DevOps, the build pipeline deploys a standard utility module named zx.jsp to the Tomcat/Apache web container as part of a larger application update. This is a known artifact in the release package, not an anomaly.
  • Filter/Exclusion: Implement a filter that suppresses alerts when the Process Name initiating the file creation corresponds to the CI/CD runner (e.g., java.exe spawned by jenkins-agent) and the file hash matches a known “Good” baseline stored in the asset inventory.

• Scenario: Legacy Application Health Check Utility

  • Context: A legacy internal application utilizes a specific health check utility named zx.jsp that is triggered every 15 minutes by an internal scheduler (Windows Task Scheduler or Cron) to verify database connectivity and generate JSON status reports. This file is frequently