Blue Mockingbird Telerik CVE-2019-18935 Exploitation: Godzilla Web Shell + SweetPotato Privilege Escalation — OTX Detection Pack

---
title: IIS Worker Process Spawning Shell or Potato Tool - Possible Telerik Exploitation
id: 7f3a1c2e-9b4d-4e8a-a1c5-2d6f8e3b9a01
status: experimental
description: Detects w3wp.exe spawning cmd, powershell, or known SweetPotato/JuicyPotato binaries, indicative of CVE-2019-18935 exploitation and post-exploitation privilege escalation per Blue Mockingbird tradecraft.
author: Security Arsenal Threat Intelligence
references:
    - https://asec.ahnlab.com/ko/95560/
date: 2026/09/28
tags:
    - attack.initial_access
    - attack.t1190
    - attack.privilege_escalation
    - attack.t1068
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\w3wp.exe'
    selection_child_img:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\whoami.exe'
    selection_child_cli:
        CommandLine|contains:
            - 'sweetpotato'
            - 'juicypotato'
            - 'PrintSpoofer'
            - '-p cmd'
    condition: selection_parent and (selection_child_img or selection_child_cli)
falsepositives:
    - Rare; legitimate IIS applications spawning shells should be tuned per environment
level: high
---
title: Outbound Reverse Shell Connection to Blue Mockingbird C2 Infrastructure
id: 8e4b2d3f-0c5e-5f9b-b2d6-3e7a9f4c0b12
status: experimental
description: Detects network connections from web server processes to known Blue Mockingbird reverse shell C2 IPs observed in Telerik CVE-2019-18935 campaigns.
author: Security Arsenal Threat Intelligence
references:
    - https://asec.ahnlab.com/ko/95560/
date: 2026/09/28
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '206.82.6.22'
            - '45.138.16.187'
            - '2.59.133.147'
            - '65.98.5.158'
    selection_proc:
        Image|endswith:
            - '\w3wp.exe'
            - '\cmd.exe'
            - '\powershell.exe'
    condition: selection_ip and 1 of selection_proc*
falsepositives:
    - Unlikely; these IPs have no legitimate business purpose
level: critical
---
title: Godzilla Web Shell File Creation in IIS Web Root
id: 9f5c3e4a-1d6f-6a0c-c3e7-4f8b0a5d1c23
status: experimental
description: Detects creation of ASPX/ASHX/ASM files in IIS web root directories by non-deployment processes, consistent with Godzilla web shell installation following Telerik exploitation.
author: Security Arsenal Threat Intelligence
references:
    - https://asec.ahnlab.com/ko/95560/
date: 2026/09/28
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: file_event
    product: windows
detection:
    selection_path:
        TargetFilename|contains:
            - '\inetpub\wwwroot\'
            - '\wwwroot\'
    selection_ext:
        TargetFilename|endswith:
            - '.aspx'
            - '.ashx'
            - '.asmx'
            - '.asp'
    filter_deploy:
        Image|endswith:
            - '\msdeploy.exe'
            - '\devenv.exe'
            - '\dotnet.exe'
    condition: selection_path and selection_ext and not filter_deploy
falsepositives:
    - Manual web deployments; tune with known deployment accounts and maintenance windows
level: high

// Hunt for Telerik exploitation + Godzilla/SweetPotato post-exploitation chain
let C2IPs = dynamic(["206.82.6.22", "45.138.16.187", "2.59.133.147", "65.98.5.158"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "whoami.exe", "nltest.exe"]);
// Stage 1: IIS worker process spawning suspicious child processes (post-exploit / Potato privesc)
let ProcHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessCommandLine, ProcessId
| extend Stage = "IIS child process";
// Stage 2: Outbound connections to known C2 from web server hosts
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (C2IPs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| extend Stage = "C2 connection";
// Stage 3: Web shell file writes to web root (requires DeviceFileEvents coverage)
let FileHits = DeviceFileEvents
| where TimeGenerated > ago(30d)
| where FolderPath has_any ("\\inetpub\\wwwroot\\", "\\wwwroot\\")
| where FileName endswith ".aspx" or FileName endswith ".ashx" or FileName endswith ".asmx"
| where InitiatingProcessFileName !in~ ("msdeploy.exe", "devenv.exe", "dotnet.exe")
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, SHA256
| extend Stage = "Web shell write";
union ProcHits, NetHits, FileHits
| order by DeviceName asc, TimeGenerated asc

# Blue Mockingbird / Godzilla Web Shell Hunt - run on IIS servers or via remote sweep
# Checks web roots for recent web shells, suspicious scheduled tasks/services, and C2 connections

$C2IPs = @("206.82.6.22", "45.138.16.187", "2.59.133.147", "65.98.5.158")
$Md5IOC = "0a4be0b6c650ffdcd1c22db56f1c4aec"
$WebRoots = @("C:\inetpub\wwwroot")

Write-Host "=== [1] Recent ASPX/ASHX files in web roots (last 60 days) ===" -ForegroundColor Cyan
foreach ($root in $WebRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.aspx,*.ashx,*.asmx,*.asp -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-60) } |
        Select-Object FullName, LastWriteTime, Length | Format-Table -AutoSize
    }
}

Write-Host "=== [2] Hash check against known IOC ===" -ForegroundColor Cyan
foreach ($root in $WebRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $h = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($h -and $h.ToLower() -eq $Md5IOC) {
                Write-Host "[ALERT] IOC hash match: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "=== [3] Active/established connections to C2 IPs ===" -ForegroundColor Cyan
Get-NetTCPConnection -ErrorAction SilentlyContinue |
Where-Object { $C2IPs -contains $_.RemoteAddress } |
ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    Write-Host "[ALERT] $($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) [$($_.State)] PID $($_.OwningProcess) ($($proc.ProcessName))" -ForegroundColor Red
}

Write-Host "=== [4] Suspicious scheduled tasks running as SYSTEM (SweetPotato follow-on) ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {
    $_.Principal.UserId -match "SYSTEM" -and
    ($_.Actions.Execute -match "cmd|powershell|pwsh|\.tmp|AppData")
} | Select-Object TaskName, TaskPath, @{N='Action';E={$_.Actions.Execute}} | Format-Table -AutoSize

Write-Host "=== [5] Services created in last 30 days (privesc persistence check) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue |
Select-Object TimeCreated, @{N='Service';E={($_.Properties[0].Value)}}, @{N='Binary';E={($_.Properties[1].Value)}} |
Format-Table -AutoSize

Write-Host "=== [6] w3wp.exe child process events (last 7 days, if Sysmon installed) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
Where-Object { $_.Message -match "w3wp.exe" } |
Select-Object TimeCreated, Message | Format-List