AhsayCBS Under Active Attack: Defending Backup Servers Against Webshell Deployment and Cryptomining Campaigns

---
title: AhsayCBS Java Process Spawning Shell or Script Interpreter
id: 3f8a1c2e-7b4d-4e91-a2c6-9d5f0b8e3a71
status: experimental
description: Detects the AhsayCBS/Tomcat Java process spawning command shells or script interpreters, consistent with webshell post-exploitation activity reported in the AhsayCBS exploitation campaign.
references:
  - https://www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1059
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
      - '\tomcat.exe'
  selection_parent_path:
    ParentImage|contains:
      - '\AhsayCBS\'
      - '\Ahsay\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_parent_path and selection_child
falsepositives:
  - Rare. AhsayCBS legitimately invokes some helper scripts during backup jobs, but shells spawned directly from the Tomcat Java process outside scheduled backup windows warrant immediate triage.
level: high
---
title: JSP Webshell File Written to AhsayCBS Tomcat Web Directory
id: 8c2e5a91-4d6b-4f37-b8a2-1e9c7d3f5a06
status: experimental
description: Detects creation of JSP files in AhsayCBS Tomcat web application directories, a key indicator of webshell deployment following exploitation of the unpatched AhsayCBS vulnerabilities.
references:
  - https://www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\AhsayCBS\webapps\'
      - '\AhsayCBS\web\'
      - '\AhsayCBS\tomcat\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.war'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate AhsayCBS version upgrades write JSP files. Correlate with patch/upgrade maintenance windows; any JSP write outside a vendor upgrade is malicious until proven otherwise.
level: critical
---
title: Suspicious Child Process of AhsayCBS Service on Linux
id: 1b7d4e26-9a3c-4f58-8d1b-6c2a5e7f9b40
status: experimental
description: Detects the AhsayCBS Java process on Linux spawning shells, downloaders, or common miner staging tools, consistent with the reported post-exploitation chain.
references:
  - https://www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/chmod'
      - '/crontab'
      - '/base64'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - AhsayCBS invokes helper utilities during backup/restore jobs. Tighten by correlating with backup schedule and by inspecting full command lines for download cradles or miner flags (stratum, xmrig, --donate-level, hugepages).
level: high

// Hunt: AhsayCBS exploitation — webshell writes + suspicious child processes
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","wmic.exe","certutil.exe","bitsadmin.exe","mshta.exe","curl.exe","rundll32.exe","sh","bash","wget","curl","crontab","base64"]);
let procHits = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("java.exe","javaw.exe","tomcat.exe","java")
   or InitiatingProcessCommandLine has_any ("AhsayCBS","ahsay","cbs")
| where FileName in~ (suspiciousChildren)
   or ProcessCommandLine has_any ("stratum","xmrig","donate-level","hugepages","/dev/tcp","IEX","Invoke-Expression","FromBase64String")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, ReportId;
let fileHits = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has_any ("AhsayCBS\\webapps","AhsayCBS\\web","AhsayCBS\\tomcat","/usr/local/cbs/","/opt/cbs/")
| where FileName endswith ".jsp" or FileName endswith ".war"
| where ActionType in ("FileCreated","FileModified","FileRenamed")
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType, SHA256, ReportId;
union procHits, fileHits
| order by TimeGenerated desc

// Hunt: Miner staging artifacts and pool connections from AhsayCBS hosts (Syslog/CEF)
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has_any ("java","sh","bash")
| where SyslogMessage has_any ("/usr/local/cbs","/opt/cbs","stratum","xmrig","cryptonight","/tmp/.", "chmod 777")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

-- AhsayCBS Compromise Sweep: webshells, suspicious child processes, miner staging
-- Deploy as a hunt scoped to servers running AhsayCBS

LET webshells = SELECT FullPath, Size, Mtime, Btime,
       read_file(filename=FullPath, length=4096) AS Head
FROM glob(globs=[
  'C:/Program Files/AhsayCBS/webapps/**/*.jsp',
  'C:/Program Files/AhsayCBS/web/**/*.jsp',
  '/usr/local/cbs/webapps/**/*.jsp',
  '/opt/cbs/webapps/**/*.jsp'
])
WHERE Mtime > now() - 1209600  -- modified in last 14 days

LET suspicious_procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(stratum|xmrig|cryptonight|donate-level|/dev/tcp|base64 -d|certutil -decode)'
   OR (Name =~ '(?i)^(cmd|powershell|pwsh|sh|bash|curl|wget)$'
       AND CommandLine =~ '(?i)(http://|https://|/tmp/|%TEMP%|appdata)')

LET tmp_staging = SELECT FullPath, Size, Mtime
FROM glob(globs=['/tmp/*','/var/tmp/*','C:/Windows/Temp/*.exe','C:/Users/Public/*.exe'])
WHERE Mtime > now() - 1209600 AND Size > 100000

SELECT * FROM webshells

#Requires -RunAsAdministrator
# AhsayCBS Emergency Audit & Hardening — run on every AhsayCBS host
# 1) Webshell sweep, 2) Process/network triage, 3) Compensating firewall controls

$ErrorActionPreference = 'SilentlyContinue'
$report = "C:\Windows\Temp\AhsayCBS_Audit_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
"=== AhsayCBS Compromise Audit $(Get-Date) ===" | Out-File $report

# --- 1. Webshell sweep: JSP/WAR files modified in last 30 days under AhsayCBS ---
$cbsRoot = 'C:\Program Files\AhsayCBS'
"`n[1] Recent JSP/WAR files under $cbsRoot" | Out-File $report -Append
Get-ChildItem -Path $cbsRoot -Recurse -Include *.jsp,*.jspx,*.war -File |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
  Select-Object FullName, LastWriteTime, Length |
  Format-Table -AutoSize | Out-String | Out-File $report -Append

# --- 2. Process tree triage: shells/miners spawned under java/tomcat ---
"`n[2] Suspicious child processes of java/tomcat" | Out-File $report -Append
$javaProcs = Get-CimInstance Win32_Process | Where-Object { $_.Name -match '^(java|javaw|tomcat).*\.exe$' }
foreach ($jp in $javaProcs) {
  Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -eq $jp.ProcessId } |
    Where-Object { $_.Name -match 'cmd|powershell|pwsh|wscript|cscript|wmic|certutil|bitsadmin|mshta|curl|rundll32' } |
    Select-Object Name, ProcessId, CommandLine |
    Format-List | Out-String | Out-File $report -Append
}

# Miner string scan across running processes
"`n[3] Processes with miner indicators in command line" | Out-File $report -Append
Get-CimInstance Win32_Process |
  Where-Object { $_.CommandLine -match 'stratum|xmrig|cryptonight|donate-level|hugepages' } |
  Select-Object Name, ProcessId, ExecutablePath, CommandLine |
  Format-List | Out-String | Out-File $report -Append

# Outbound listeners/connections on common pool ports
"`n[4] Connections to common mining pool ports" | Out-File $report -Append
Get-NetTCPConnection -State Established |
  Where-Object { $_.RemotePort -in 3333,4444,5555,7777,14444 } |
  Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess |
  Format-Table -AutoSize | Out-String | Out-File $report -Append

# --- 5. COMPENSATING CONTROL: restrict AhsayCBS console (8080/8443) to mgmt subnet ---
# Adjust -RemoteAddress to YOUR management network before enabling.
$mgmtSubnet = '10.10.50.0/24'
"`n[5] Applying firewall restriction on AhsayCBS console ports to $mgmtSubnet" | Out-File $report -Append
New-NetFirewallRule -DisplayName 'AhsayCBS Console - Mgmt Only (8080)' `
  -Direction Inbound -Protocol TCP -LocalPort 8080 -RemoteAddress $mgmtSubnet -Action Allow | Out-Null
New-NetFirewallRule -DisplayName 'AhsayCBS Console - Mgmt Only (8443)' `
  -Direction Inbound -Protocol TCP -LocalPort 8443 -RemoteAddress $mgmtSubnet -Action Allow | Out-Null
New-NetFirewallRule -DisplayName 'AhsayCBS Console - Block All Else (8080)' `
  -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Block | Out-Null
New-NetFirewallRule -DisplayName 'AhsayCBS Console - Block All Else (8443)' `
  -Direction Inbound -Protocol TCP -LocalPort 8443 -Action Block | Out-Null

"`nAudit complete. Review $report and escalate any hits to IR immediately." | Out-File $report -Append
Write-Host "Done — report at $report"