name: Java Writing JSP File
id: eb65619c-4f8d-4383-a975-d352765d344b
version: 3
date: '2024-05-27'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the Java process writing a .jsp file to
  disk, which may indicate a web shell being deployed. It leverages data from the
  Endpoint datamodel, specifically monitoring process and filesystem activities. This
  activity is significant because web shells can provide attackers with remote control
  over the compromised server, leading to further exploitation. If confirmed malicious,
  this could allow unauthorized access, data exfiltration, or further compromise of
  the affected system, posing a severe security risk.
data_source:
- Sysmon EventID 11
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
  where Processes.process_name IN ("java","java.exe", "javaw.exe") by _time Processes.process_id
  Processes.process_name Processes.dest Processes.process_guid Processes.user | `drop_dm_object_name(Processes)`
  | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
  where Filesystem.file_name="*.jsp*" by _time Filesystem.dest Filesystem.file_create_time
  Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.user
  | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name
  file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time)
  as lastTime by dest process_name process_guid file_name file_path file_create_time
  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `java_writing_jsp_file_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
  node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
  latest TA for the endpoint product.
known_false_positives: False positives are possible and filtering may be required.
  Restrict by assets or filter known jsp files that are common for the environment.
references:
- https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/
- https://github.com/TheGejr/SpringShell
- https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
tags:
  analytic_story:
  - Spring4Shell CVE-2022-22965
  - Atlassian Confluence Server and Data Center CVE-2022-26134
  - SysAid On-Prem Software CVE-2023-47246 Vulnerability
  asset_type: Endpoint
  confidence: 70
  cve:
  - CVE-2022-22965
  impact: 60
  message: An instance of $process_name$ was identified on endpoint $dest$ writing
    a jsp file $file_name$ to disk, potentially indicative of exploitation.
  mitre_attack_id:
  - T1190
  - T1133
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.dest
  - Processes.user
  - Processes.parent_process_name
  - Processes.parent_process
  - Processes.original_file_name
  - Processes.process_name
  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  - Filesystem.dest
  - Filesystem.file_create_time
  - Filesystem.file_name
  - Filesystem.file_path
  - Filesystem.process_guid
  - Filesystem.user
  risk_score: 42
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: 
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log
    source: Syslog:Linux-Sysmon/Operational
    sourcetype: sysmon:linux