Web Shell - file Jspspyweb.jsp

Hunt Hypothesis

This detection identifies adversaries who have deployed a malicious JSP web shell named Jspspyweb.jsp to establish persistent access and execute arbitrary commands on compromised web servers. Proactive hunting for this artifact in Azure Sentinel is critical because web shells often serve as the initial foothold for attackers, enabling them to pivot laterally within the environment before triggering standard alerting mechanisms.

YARA Rule

rule webshell_Jspspyweb {
	meta:
		description = "Web Shell - file Jspspyweb.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "4e9be07e95fff820a9299f3fb4ace059"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "      out.print(\"<tr><td width='60%'>\"+strCut(convertPath(list[i].getPath()),7"
		$s3 = "  \"reg add \\\"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file Jspspyweb.jsp detection rule, including suggested filters and exclusions:

• Scenario: Automated Deployment by CI/CD Pipeline

  • Context: The enterprise uses Jenkins or GitLab CI to deploy a new version of the monitoring application. During the deployment phase, the pipeline script explicitly creates Jspspyweb.jsp in the web root directory as part of the standard artifact bundle. This file is legitimate and expected in every release cycle.
  • Filter/Exclusion: Exclude events where the source process name matches the CI/CD agent (e.g., java.exe running under user jenkins-build) or filter by the specific deployment directory path (e.g., /opt/tomcat/webapps/deploy-staging).

• Scenario: Scheduled Health Check Job

  • Context: A nightly scheduled task managed by Windows Task Scheduler or a Cron job on Linux executes a script that regenerates the Jspspyweb.jsp file to refresh session tokens and update internal metrics. This occurs every day at 02:00 AM UTC, creating a new file instance even if one already exists.
  • Filter/Exclusion: Create an exclusion for events occurring between 01:30 and 02:30 UTC where the parent process is svchost.exe (Windows) or cron (Linux) and the user context is a dedicated service account like svc-healthcheck.

• Scenario: Application Server Maintenance by DevOps Admin

  • Context: A DevOps administrator manually performs maintenance on the Apache Tomcat server using an SSH session. As part of the troubleshooting workflow, they copy a standard template file named Jspspyweb.jsp from a backup repository to