Web Shell - file minupload.jsp

Hunt Hypothesis

This detection identifies adversaries deploying a malicious JSP web shell named minupload.jsp to establish persistent access and execute commands on compromised web servers. A proactive hunt is essential in Azure Sentinel to rapidly identify this specific artifact before attackers leverage it for lateral movement or data exfiltration within the organization’s cloud infrastructure.

YARA Rule

rule webshell_minupload {
	meta:
		description = "Web Shell - file minupload.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "ec905a1395d176c27f388d202375bdf9"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">   " fullword
		$s9 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file minupload.jsp detection rule, including targeted filters and exclusions:

• Scenario: Scheduled Backup of Legacy JSP Components

  • Context: The enterprise runs a nightly backup job using Veeam Backup & Replication or Commvault that archives the entire webapps directory. During this process, the backup agent reads and occasionally re-writes metadata for existing JSP files, including minupload.jsp, triggering the rule as if a new file was uploaded by an untrusted source.
  • Filter/Exclusion: Exclude processes running under the specific service account used by the backup solution (e.g., VeeamTransport.exe or commvault_agent) when accessing paths within the /var/lib/tomcat/webapps/ directory.

• Scenario: Automated Deployment via CI/CD Pipeline

  • Context: The DevOps team utilizes Jenkins or GitLab CI to deploy updates to the production Tomcat server. As part of a standard deployment script, the pipeline pushes configuration files and utility JSPs (including minupload.jsp) from an artifact repository (e.g., Nexus Repository) to the server using the jenkins-build user account.
  • Filter/Exclusion: Create a rule exclusion for file creation events where the source process is identified as java.exe (Jenkins Agent) or gitlab-runner, and the user context matches the deployment service account (e.g., svc-deploy-tomcat).

• Scenario: Application Patching by System Administrator

  • Context: A system administrator manually applies a security patch to the web application server using PowerShell or Ansible Tower. The automation script explicitly copies the updated minupload.jsp file from a secure staging