Web Shell - file spjspshell.jsp

Hunt Hypothesis

This detection identifies adversaries deploying a JSP-based web shell named spjspshell.jsp to establish persistent remote access and execute commands on compromised web servers. Proactive hunting for this artifact in Azure Sentinel is critical because web shells often serve as an initial foothold for lateral movement, allowing attackers to maintain stealthy control over the environment before broader detection occurs.

YARA Rule

rule webshell_spjspshell {
	meta:
		description = "Web Shell - file spjspshell.jsp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		date = "2014/01/28"
		score = 70
		hash = "d39d51154aaad4ba89947c459a729971"
		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
	strings:
		$s7 = "Unix:/bin/sh -c tar vxf xxx.tar Windows:c:\\winnt\\system32\\cmd.exe /c type c:"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Web Shell - file spjspshell.jsp detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup or Migration Scripts by DevOps Tools

  • Context: Enterprise DevOps teams often use tools like Jenkins, GitLab CI/CD, or Ansible to deploy application artifacts. During a deployment pipeline, these agents may temporarily create or update standard JSP files (including spjspshell.jsp) in the web root directory as part of a staging process before finalizing the build.
  • Suggested Filter: Exclude events where the source user account is a known service account (e.g., svc-jenkins, gitlab-runner) and the parent process is the automation tool executable (e.g., java.exe running as a Jenkins agent or ansible-playbook).

• Scenario: Scheduled Health Check by Monitoring Agents

  • Context: Infrastructure monitoring solutions like Datadog, New Relic, or SolarWinds often perform periodic health checks on web servers. These agents may generate temporary JSP files to test server responsiveness or verify specific module availability, triggering the rule when they write spjspshell.jsp during a scheduled maintenance window (e.g., every 15 minutes).
  • Suggested Filter: Create an exclusion based on time-of-day logic for known monitoring service accounts. Additionally, filter out events where the file size remains constant (indicating a read-only check or overwrite of identical content) and the process name matches the monitoring agent (e.g., dd-agent.exe, nrdc.exe).

• Scenario: Administrator Manual Configuration via Integrated Development Environments

  • Context: System administrators frequently use IDEs like IntelliJ IDEA, Eclipse, or Visual Studio Code to manually edit web