Web Shell - file mumaasp.com.asp

Hunt Hypothesis

This rule detects the creation of a suspicious web shell named mumaasp.com.asp, which adversaries often deploy to establish persistent access and execute commands on compromised web servers. The SOC team should proactively hunt for this artifact in Azure Sentinel because web shells serve as critical footholds that enable attackers to pivot laterally, exfiltrate sensitive data, or maintain long-term command-and-control capabilities within the environment.

YARA Rule

rule webshell_mumaasp_com {
	meta:
		description = "Web Shell - file mumaasp.com.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "cce32b2e18f5357c85b6d20f564ebd5d"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s0 = "&9K_)P82ai,A}I92]R\"q!C:RZ}S6]=PaTTR"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Web Shell - file mumaasp.com.asp detection rule, including suggested filters and exclusions:

• Scheduled Backup or Migration Scripts

  • Scenario: An automated nightly backup job (e.g., using Veeam Agent, Robocopy, or a custom PowerShell script) copies legacy application assets to the web root. The file mumaasp.com.asp is part of a standard library package that gets recreated during these sync operations, triggering the “new suspicious file” alert despite being a known artifact.
  • Filter/Exclusion: Create an exclusion for files created by specific service accounts (e.g., DOMAIN\BackupSvc) or exclude file paths matching C:\InetPub\wwwroot\LegacyApps\mumaasp.com.asp if the file hash matches the baseline of the known good version.

• Application Deployment via CI/CD Pipelines

  • Scenario: A DevOps team deploys a new release using Azure DevOps, Jenkins, or GitHub Actions. The deployment process extracts an archive containing mumaasp.com.asp to the IIS web directory. Since this is a standard component of the application stack, its creation during a deployment window mimics the behavior of a malicious web shell upload.
  • Filter/Exclusion: Implement a time-based exclusion or correlation rule that suppresses alerts for this specific file if the event occurs within 15 minutes of a successful CI/CD pipeline completion log (e.g., matching PipelineID in the deployment metadata).

• Third-Party Analytics or Monitoring Agent Installation

  • Scenario: A security or performance monitoring tool, such as Dynatrace, New Relic, or SolarWinds AppManager, installs a lightweight ASP agent to monitor web traffic. The installation routine