name: Java Writing JSP File
id: eb65619c-4f8d-4383-a975-d352765d344b
version: 2
date: '2022-06-03'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies the process java writing a .jsp to
  disk. This is potentially indicative of a web shell being written to disk. Modify
  and tune the analytic based on data ingested. For instance, it may be worth running
  a broad query for jsp file writes first before performing a join.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    Image|endswith:
    - java
    - java.exe
    - javaw.exe
  condition: selection1
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
  node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
  latest TA for the endpoint product.
known_false_positives: False positives are possible and filtering may be required.
  Restrict by assets or filter known jsp files that are common for the environment.
references:
- https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/
- https://github.com/TheGejr/SpringShell
- https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
tags:
  analytic_story:
  - Spring4Shell CVE-2022-22965
  - Atlassian Confluence Server and Data Center CVE-2022-26134
  - SysAid On-Prem Software CVE-2023-47246 Vulnerability
  asset_type: Endpoint
  confidence: 70
  cve:
  - CVE-2022-22965
  impact: 60
  message: An instance of $process_name$ was identified on endpoint $dest$ writing
    a jsp file to disk, potentially indicative of exploitation.
  mitre_attack_id:
  - T1190
  - T1133
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: parent_process_name
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 42
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log
    source: Syslog:Linux-Sysmon/Operational
    sourcetype: sysmon:linux