AntiFox AI Pentest Platform Weaponized to Steal AWS Credentials — Detection and Hardening Guide for IIS and Cloud Teams

---
title: IIS Worker Process Spawning Command Shell or Discovery Tools
id: 3f8a2b71-6c4d-4e9f-b1a7-9d5c2e8f3a01
status: experimental
description: Detects w3wp.exe spawning cmd.exe, powershell.exe, or common post-exploitation discovery binaries — consistent with web shell activity observed in AntiFox-driven IIS intrusions.
references:
  - https://securityaffairs.com/202880/hacking/ai-pentest-tool-antifox-abused-to-steal-aws-credentials.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\ipconfig.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare — some legacy web applications legitimately shell out; baseline per application pool
level: high
---
title: AWS Credentials File Access by Non-Interactive Process
id: 8c1d4e62-2a7b-4f35-9d08-6b3e1a9c5f42
status: experimental
description: Detects read access to the AWS CLI credentials file by processes outside an expected admin/developer context — consistent with cloud credential harvesting observed in AntiFox intrusions.
references:
  - https://securityaffairs.com/202880/hacking/ai-pentest-tool-antifox-abused-to-steal-aws-credentials.html
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains: '\.aws\credentials'
  filter_legit:
    Image|endswith:
      - '\aws.exe'
      - '\awscliv2.exe'
  condition: selection_path and not filter_legit
falsepositives:
  - Backup agents or EDR scanners reading user profile directories; tune by Image hash
level: high
---
title: Web Server Process Querying Cloud Instance Metadata Service
id: 5e9b3d18-7f2a-4c61-a384-2d8f6b0e9c17
status: experimental
description: Detects IIS or script processes issuing HTTP requests to the EC2 instance metadata endpoint (169.254.169.254) — a hallmark of IAM role credential theft from compromised cloud-hosted web servers.
references:
  - https://securityaffairs.com/202880/hacking/ai-pentest-tool-antifox-abused-to-steal-aws-credentials.html
  - https://attack.mitre.org/techniques/T1552/005/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.credential_access
  - attack.t1552.005
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationIp: '169.254.169.254'
  selection_proc:
    Image|endswith:
      - '\w3wp.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\python.exe'
  condition: selection_dest and selection_proc
falsepositives:
  - Legitimate applications that retrieve IMDS configuration at startup; correlate with timing and command line
level: critical

// Hunt: AntiFox-style IIS compromise -> shell spawning -> AWS credential theft
let lookback = 14d;
let webShellProcs = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","whoami.exe","net.exe","ipconfig.exe","curl.exe","certutil.exe","bitsadmin.exe")
| project WebShellTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, ReportId;
let credAccess = DeviceFileEvents
| where TimeGenerated > ago(lookback)
| where FolderPath has @"\.aws\credentials"
| where InitiatingProcessFileName !in~ ("aws.exe","awscliv2.exe","MsMpEng.exe")
| project CredTime=TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath;
let imdsAccess = DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteIP == "169.254.169.254"
| where InitiatingProcessFileName in~ ("w3wp.exe","powershell.exe","pwsh.exe","cmd.exe","curl.exe","python.exe")
| project ImdsTime=TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl;
webShellProcs
| join kind=leftouter credAccess on DeviceName
| join kind=leftouter imdsAccess on DeviceName
| project DeviceName, WebShellTime, FileName, ProcessCommandLine, CredTime, InitiatingProcessFileName1, ImdsTime, RemoteUrl
| order by DeviceName asc, WebShellTime asc

-- Hunt: IIS post-exploitation lineage + AWS credential artifacts (AntiFox campaign)
LET suspicious_children = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)w3wp|cmd|powershell|pwsh|whoami|curl|certutil'

LET parent_lookup = SELECT Pid AS P_Pid, Name AS P_Name, Exe AS P_Exe
FROM pslist()

LET webshell_lineage = SELECT s.Pid, s.Name, s.CommandLine, s.Username, s.CreateTime,
       p.P_Name AS ParentName, p.P_Exe AS ParentPath
FROM suspicious_children s
JOIN parent_lookup p ON s.Ppid = p.P_Pid
WHERE p.P_Name =~ '(?i)w3wp'

LET aws_cred_files = SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Users/*/.aws/credentials','C:/Windows/System32/config/systemprofile/.aws/credentials','C:/Windows/SysWOW64/config/systemprofile/.aws/credentials'])

SELECT * FROM webshell_lineage
UNION ALL
SELECT NULL AS Pid, 'AWS_CRED_FILE' AS Name, FullPath AS CommandLine,
       '' AS Username, Mtime AS CreateTime, '' AS ParentName, '' AS ParentPath
FROM aws_cred_files

# AntiFox Campaign - IIS + AWS Credential Exposure Triage & Hardening
# Run elevated on each IIS server. Outputs to C:\IR-Triage\ for collection.

$out = "C:\IR-Triage"
New-Item -ItemType Directory -Path $out -Force | Out-Null

# 1. Detect suspicious child processes spawned by IIS worker processes
Get-CimInstance Win32_Process | Where-Object {
    $_.Name -match '^(cmd|powershell|pwsh|whoami|net|net1|ipconfig|curl|certutil|bitsadmin)\.exe$'
} | ForEach-Object {
    $parent = Get-CimInstance Win32_Process -Filter "ProcessId=$($_.ParentProcessId)" -ErrorAction SilentlyContinue
    if ($parent -and $parent.Name -eq 'w3wp.exe') {
        [PSCustomObject]@{
            Alert      = 'IIS_SPAWNED_SHELL'
            Time       = $_.CreationDate
            ChildProc  = $_.Name
            CommandLine= $_.CommandLine
            ParentPID  = $_.ParentProcessId
        }
    }
} | Export-Csv "$out\iis_spawned_shells.csv" -NoTypeInformation

# 2. Hunt for AWS credential files in profiles where they should NOT exist
$credPaths = @(
    "$env:SystemRoot\System32\config\systemprofile\.aws\credentials",
    "$env:SystemRoot\SysWOW64\config\systemprofile\.aws\credentials"
)
$credPaths += Get-ChildItem "C:\Users" -Directory -ErrorAction SilentlyContinue |
    ForEach-Object { Join-Path $_.FullName ".aws\credentials" }
foreach ($p in $credPaths) {
    if (Test-Path $p) {
        $f = Get-Item $p
        "[ALERT] AWS credentials file found: $p (Modified: $($f.LastWriteTime)) - ROTATE THESE KEYS NOW" |
            Out-File "$out\aws_cred_exposure.txt" -Append
    }
}

# 3. Triage: recently written script files in web roots (potential web shells)
$webRoots = (Get-WebConfigurationProperty "//site/application/virtualDirectory" -Name physicalPath -ErrorAction SilentlyContinue).Value | Sort-Object -Unique
if (-not $webRoots) { $webRoots = @("C:\inetpub\wwwroot") }
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem $root -Recurse -Include *.aspx,*.ashx,*.asmx,*.asp -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
            Select-Object FullName, LastWriteTime, Length |
            Export-Csv "$out\recent_webroot_scripts.csv" -NoTypeInformation -Append
    }
}

# 4. If this host is EC2: verify IMDSv2 is enforced (blocks SSRF-style credential theft)
try {
    $token = Invoke-RestMethod -Method PUT -Uri "http://169.254.169.254/latest/api/token" `
        -Headers @{ "X-aws-ec2-metadata-token-ttl-seconds" = "21600" } -TimeoutSec 3
    $instanceId = Invoke-RestMethod -Uri "http://169.254.169.254/latest/meta-data/instance-id" `
        -Headers @{ "X-aws-ec2-metadata-token" = $token } -TimeoutSec 3
    "[INFO] EC2 instance $instanceId - enforce IMDSv2:" | Out-File "$out\imds_check.txt"
    "aws ec2 modify-instance-metadata-options --instance-id $instanceId --http-tokens required --http-endpoint enabled" |
        Out-File "$out\imds_check.txt" -Append
} catch {
    "[INFO] Not an EC2 instance or IMDS unreachable." | Out-File "$out\imds_check.txt"
}

# 5. Restrict outbound metadata access from the web process context (defense in depth on EC2)
# NOTE: Test before enforcing - legitimate apps may need IMDS.
New-NetFirewallRule -DisplayName "Block IMDS for w3wp" -Direction Outbound `
    -RemoteAddress 169.254.169.254 -Program "C:\Windows\System32\inetsrv\w3wp.exe" `
    -Action Block -ErrorAction SilentlyContinue | Out-Null

Write-Host "Triage complete. Review $out and rotate any discovered AWS keys immediately."