YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_WEBSHELL_ASPX_Xsltransform_Aug21

Detects an ASPX webshell utilizing XSL Transformations

WebshellSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Max Altgelt
Date: 2020-02-23
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Detects an ASPX webshell utilizing XSL Transformations

It defines 6 patterns (6 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

webshell-aspx-xsltransform-aug21.yarDetection Rule License 1.1

rule SIGNATURE_BASE_WEBSHELL_ASPX_Xsltransform_Aug21 : FILE
{
	meta:
		description = "Detects an ASPX webshell utilizing XSL Transformations"
		author = "Max Altgelt"
		id = "44254084-a717-59e6-a3ac-eca3c1c864a8"
		date = "2020-02-23"
		modified = "2023-12-05"
		reference = "https://gist.github.com/JohnHammond/cdae03ca5bc2a14a735ad0334dcb93d6"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/webshell_xsl_transform.yar#L1-L19"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "3ac0b50adc4c56769d0248e213e9426a22e0f5086bf081da57f835ff1c77b716"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$csharpshell = "Language=\"C#\"" nocase
		$x1 = "<root>1</root>"
		$x2 = ".LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String("
		$s1 = "XsltSettings.TrustedXslt"
		$s2 = "Xml.XmlUrlResolver"
		$s3 = "FromBase64String(Request[\""

	condition:
		filesize < 500KB and $csharpshell and ( 1 of ( $x* ) or all of ( $s* ) )
}

Strings (6 patterns)

Identifier	Type	Value	Modifiers
$csharpshell	text	"Language=\"C#\""	nocase
$x1	text	"<root>1</root>"
$x2	text	".LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String("
$s1	text	"XsltSettings.TrustedXslt"
$s2	text	"Xml.XmlUrlResolver"
$s3	text	"FromBase64String(Request[\""

Condition

filesize < 500KB and $csharpshell and ( 1 of ( $x* ) or all of ( $s* ) )

In plain words (Heuristic)

The file must be smaller than 500KB (a cheap guard that skips large files).
All patterns in ( $s* ) must match.
At least 1 patterns in ( $x* ) must match.
Pattern $csharpshell must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://gist.github.com/JohnHammond/cdae03ca5bc2a14a735ad0334dcb93d6

Licence & attribution

Author: Max Altgelt

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 44254084-a717-59e6-a3ac-eca3c1c864a8

Tags:FILE

SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug21_3
WebshellSignature Base (Florian Roth / Nextron)· Max Altgelt· 2021-08-23