Web Shell - file jspShell.jsp

Hunt Hypothesis

This detection identifies adversaries who have deployed a JSP web shell to establish a persistent foothold on a compromised web server for command execution and data exfiltration. Proactively hunting for this artifact in Azure Sentinel is critical because web shells often serve as the initial entry point for lateral movement, allowing attackers to maintain stealthy access before triggering broader alerting mechanisms.

YARA Rule

rule webshell_jspShell {
	meta:
		description = "Web Shell - file jspShell.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "0d5b5a17552254be6c1c8f1eb3a5fdc1"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "<input type=\"checkbox\" name=\"autoUpdate\" value=\"AutoUpdate\" on"
		$s1 = "onblur=\"document.shell.autoUpdate.checked= this.oldValue;"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file jspShell.jsp detection rule, including targeted filters and exclusions:

• Scenario: Deployment of Official Application Updates via CI/CD Pipeline

  • Context: The enterprise uses Jenkins or GitLab CI to deploy updated application modules. During a scheduled nightly build, the pipeline automatically deploys jspShell.jsp as part of a standard library update for the legacy customer portal, which includes this file in its artifact bundle.
  • Filter/Exclusion: Create an exclusion based on the source identity and timing. Exclude alerts where the Source User is ci-deploy-bot (or specific service account) AND the event occurs during the defined maintenance window (e.g., 02:00–04:00 UTC).
  • Logic: IF SourceUser == 'ci-deploy-bot' AND EventTime BETWEEN [MaintenanceWindowStart, MaintenanceWindowEnd] THEN Suppress.

• Scenario: Scheduled Backup and Archiving Tasks

  • Context: The organization runs a daily backup job using Veeam or Commvault that archives the entire web root directory. During the archiving process, the backup agent may temporarily instantiate or copy jspShell.jsp into a staging folder before compression, triggering the file creation event.
  • Filter/Exclusion: Exclude events where the Process Name matches known backup agents (e.g., vrb.exe, vcagent.exe) and the destination path contains specific backup staging directories (e.g., \BackupStaging\).
  • Logic: IF ProcessName IN ['vrb.exe', 'vcagent.exe'] AND DestinationPath CONTAINS '\BackupStaging\' THEN Suppress.

• Scenario: Administrator Manual Maintenance via Remote Desktop

  ---