Capcom Data Breach: Defending Identity Infrastructure After the 2026 Gaming Giant Compromise

---
title: Suspicious Web Shell File Creation in Web Directories
id: 8f9e2d1c-4a5b-4c6d-9e8f-1a2b3c4d5e6f
status: experimental
description: Detects creation of potential web shell files in web server directories following initial compromise of gaming infrastructure.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\www\'
      - '\htdocs\'
      - '\webapps\'
    TargetFilename|endswith:
      - '.aspx'
      - '.asp'
      - '.php'
      - '.jsp'
      - '.asmx'
  filter_known_writers:
    Image|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\tomcat.exe'
  condition: selection and not filter_known_writers
falsepositives:
  - Legitimate web deployments by administrators
  - Content management system updates
level: high
---
title: Credential Stuffing Pattern - Multiple Failed Logons from Single Source
id: 2a3b4c5d-6e7f-8a9b-0c1d-2e3f4a5b6c7d
status: experimental
description: Identifies potential credential stuffing attacks against authentication infrastructure by detecting high volumes of failed logons from single sources.
references:
  - https://attack.mitre.org/techniques/T1110/004/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1110.004
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventID: 4625
    LogonType: 3
  timeframe: 5m
  condition: selection | count() by IpAddress > 20
falsepositives:
  - Misconfigured service accounts
  - Load balancer health checks
level: high
---
title: Web Server Process Spawning Command Shell
id: 3b4c5d6e-7f8a-9b0c-1d2e-3f4a5b6c7d8e
status: experimental
description: Detects web server processes spawning command shells, indicative of web shell execution or exploitation activity.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\tomcat.exe'
      - '\php-cgi.exe'
  selection_image:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\sh.exe'
      - '\bash.exe'
  condition: selection_parent and selection_image
falsepositives:
  - Legitimate administrative scripts
  - Monitoring agents
level: critical

// Hunt for credential stuffing and web shell activity patterns
// Query 1: Multiple failed authentication attempts (potential credential stuffing)
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4625
| where LogonType == 3
| summarize FailedAttempts = count(), UniqueUsers = dcount(TargetUserName) by IpAddress, Computer, bin(TimeGenerated, 5m)
| where FailedAttempts > 15
| sort by FailedAttempts desc

// Query 2: Web server processes spawning suspicious child processes
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "tomcat.exe", "php-cgi.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "sh.exe", "bash.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName
| sort by TimeGenerated desc

// Query 3: File creation in web directories by non-standard processes
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("inetpub", "wwwroot", "htdocs", "webapps")
| where FileName endswith_cs ".aspx" or FileName endswith_cs ".php" or FileName endswith_cs ".jsp"
| where InitiatingProcessFileName !in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "tomcat.exe", "msdeploy.exe", "VisualStudio.exe")
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine

-- Hunt for suspicious web shell files and processes on web servers
-- Artifact: WebShell_Hunt

SELECT 
    F.Path AS FilePath,
    F.Size AS FileSize,
    F.Modified AS ModifiedTime,
    P.Pid AS ProcessId,
    P.Name AS ProcessName,
    P.CommandLine AS CommandLine,
    P.Username AS ProcessUser
FROM glob(glob='/**/wwwroot/**/*.aspx', root='/')
AS F
LEFT JOIN pslist() AS P ON 1=1
WHERE F.Modified > now() - 604800  // Last 7 days
   AND (
       P.CommandLine =~ 'cmd.exe|powershell|whoami|net user|certutil'
       OR F.Path =~ 'temp|tmp|uploads|images|assets'
   )
ORDER BY F.Modified DESC

# Capcom Breach Response - Web Server Integrity Check
# Run on all IIS web servers with administrative privileges

$WebRoot = "C:\inetpub\wwwroot"
$LogFile = "C:\SecurityAudit_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
$SuspiciousExtensions = @("*.aspx", "*.asp", "*.php", "*.jsp", "*.asmx", "*.ashx")
$DaysBack = 14

Write-Output "Starting web server security audit..." | Tee-Object -FilePath $LogFile
Write-Output "Scanning: $WebRoot" | Tee-Object -FilePath $LogFile -Append

# Find recently modified script files
$RecentFiles = Get-ChildItem -Path $WebRoot -Recurse -Include $SuspiciousExtensions -ErrorAction SilentlyContinue | 
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-$DaysBack) }

Write-Output "`nRecently Modified Script Files (Last $DaysBack days):" | Tee-Object -FilePath $LogFile -Append
$RecentFiles | Select-Object FullName, LastWriteTime, Length | Format-Table -AutoSize | Tee-Object -FilePath $LogFile -Append

# Check for common web shell patterns in recently modified files
$ShellPatterns = @(
    "eval\(",
    "base64_decode",
    "System\.Diagnostics\.Process",
    "cmd\.exe",
    "powershell\.exe",
    "Request\.QueryString",
    "Request\.Form"
)

Write-Output "`nScanning for suspicious code patterns..." | Tee-Object -FilePath $LogFile -Append
foreach ($file in $RecentFiles) {
    $content = Get-Content $file.FullName -Raw -ErrorAction SilentlyContinue
    if ($content) {
        foreach ($pattern in $ShellPatterns) {
            if ($content -match $pattern) {
                Write-Output "ALERT: Potential web shell indicator found in $($file.FullName) - Pattern: $pattern" | Tee-Object -FilePath $LogFile -Append
                # Check file entropy (high entropy may indicate obfuscation)
                $bytes = [System.IO.File]::ReadAllBytes($file.FullName)
                $entropy = 0
                $byteCount = @{}.GetEnumerator()
                foreach ($byte in $bytes) { $byteCount[$byte] += 1 }
                foreach ($count in $byteCount.Values) {
                    $probability = $count / $bytes.Length
                    $entropy -= $probability * [Math]::Log($probability, 2)
                }
                if ($entropy -gt 7.0) {
                    Write-Output "HIGH ENTROPY WARNING: $($file.FullName) - Entropy: $entropy" | Tee-Object -FilePath $LogFile -Append
                }
            }
        }
    }
}

# Check for suspicious processes spawned by IIS
Write-Output "`nChecking for suspicious IIS child processes..." | Tee-Object -FilePath $LogFile -Append
$IISProcesses = Get-WmiObject Win32_Process | Where-Object { $_.Name -eq "w3wp.exe" }
foreach ($proc in $IISProcesses) {
    $children = Get-WmiObject Win32_Process | Where-Object { $_.ParentProcessId -eq $proc.ProcessId }
    foreach ($child in $children) {
        if ($child.Name -match "cmd|powershell|net|whoami|ipconfig") {
            Write-Output "SUSPICIOUS: IIS spawned $($child.Name) (PID: $($child.ProcessId)) - Command: $($child.CommandLine)" | Tee-Object -FilePath $LogFile -Append
        }
    }
}

# Audit log review recommendation
Write-Output "`nRecommended next steps:" | Tee-Object -FilePath $LogFile -Append
Write-Output "1. Review IIS logs for suspicious POST requests to recently modified files" | Tee-Object -FilePath $LogFile -Append
Write-Output "2. Check Windows Event Logs for Event ID 4625 (failed logons) from unusual sources" | Tee-Object -FilePath $LogFile -Append
Write-Output "3. Verify integrity of all web.config files" | Tee-Object -FilePath $LogFile -Append
Write-Output "4. Review database access logs for unusual query patterns" | Tee-Object -FilePath $LogFile -Append

Write-Output "`nAudit complete. Results saved to: $LogFile"