Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_WEBSHELL_JSP_Generic_Encoded_Shell

Generic JSP webshell which contains cmd or /bin/bash encoded in ascii ord

WebshellSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Arnim Rupp (https://github.com/ruppde)
Date
2021-01-07
Modified
2023-07-05
Score / Quality
75 / 83

What this rule detects

Generic JSP webshell which contains cmd or /bin/bash encoded in ascii ord

It defines 7 patterns (0 text, 0 hex, 7 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
webshell-jsp-generic-encoded-shell.yarDetection Rule License 1.1
rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Encoded_Shell : FILE
{
	meta:
		description = "Generic JSP webshell which contains cmd or /bin/bash encoded in ascii ord"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "359949d7-1793-5e13-9fdc-fe995ae12117"
		date = "2021-01-07"
		modified = "2023-07-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L6165-L6191"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "3eecc354390d60878afaa67a20b0802ce5805f3a9bb34e74dd8c363e3ca0ea5c"
		hash = "f6c2112e3a25ec610b517ff481675b2ce893cb9f"
		hash = "62e6c6065b5ca45819c1fc049518c81d7d165744"
		logic_hash = "74f45478e5bd7bb300e4ec493c2d3ef9a26340a141c3512a722618b3a3731500"
		score = 75
		quality = 83
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		importance = 70

	strings:
		$sj0 = /\{ ?47, 98, 105, 110, 47, 98, 97, 115, 104/ wide ascii
		$sj1 = /\{ ?99, 109, 100}/ wide ascii
		$sj2 = /\{ ?99, 109, 100, 46, 101, 120, 101/ wide ascii
		$sj3 = /\{ ?47, 98, 105, 110, 47, 98, 97/ wide ascii
		$sj4 = /\{ ?106, 97, 118, 97, 46, 108, 97, 110/ wide ascii
		$sj5 = /\{ ?101, 120, 101, 99 }/ wide ascii
		$sj6 = /\{ ?103, 101, 116, 82, 117, 110/ wide ascii

	condition:
		filesize < 300KB and any of ( $sj* )
}

Strings (7 patterns)

IdentifierTypeValueModifiers
$sj0regex/\{ ?47, 98, 105, 110, 47, 98, 97, 115, 104/wide ascii
$sj1regex/\{ ?99, 109, 100}/wide ascii
$sj2regex/\{ ?99, 109, 100, 46, 101, 120, 101/wide ascii
$sj3regex/\{ ?47, 98, 105, 110, 47, 98, 97/wide ascii
$sj4regex/\{ ?106, 97, 118, 97, 46, 108, 97, 110/wide ascii
$sj5regex/\{ ?101, 120, 101, 99 }/wide ascii
$sj6regex/\{ ?103, 101, 116, 82, 117, 110/wide ascii

Condition

filesize < 300KB and any of ( $sj* )

In plain words (Heuristic)

  • The file must be smaller than 300KB (a cheap guard that skips large files).
  • At least one pattern in ( $sj* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 3eecc354390d60878afaa67a20b0802ce5805f3a9bb34e74dd8c363e3ca0ea5c
  • f6c2112e3a25ec610b517ff481675b2ce893cb9f
  • 62e6c6065b5ca45819c1fc049518c81d7d165744

Licence & attribution

Author: Arnim Rupp (https://github.com/ruppde)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (stated in the rule's own meta)

“Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 359949d7-1793-5e13-9fdc-fe995ae12117

Metadata

importance70

Tags:FILE

Related rules