CVE-2026-105133: AhsayCBS Improper Authentication Exploited to Deploy XMRig Miners — Detection and Remediation Guide

---
title: AhsayCBS Java Process Spawning Shell or Script Interpreter
id: 3f8a1c94-2b6d-4e51-9a72-c4d5e6f70819
status: experimental
description: Detects the AhsayCBS backup server Java process spawning command shells, script interpreters, or download utilities, consistent with web shell execution following exploitation of CVE-2026-105133.
references:
  - https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\java.exe'
    ParentCommandLine|contains: 'ahsay'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate AhsayCBS administrative scripts should be validated and excluded by full path
level: high
---
title: XMRig Miner Masquerading as Microsoft Edge
id: 91c2d7e0-4a5b-48f3-b6d1-8e9f0a1b2c3d
status: experimental
description: Detects execution of a Microsoft Edge-named binary from a non-standard path or with XMRig-style command-line arguments, matching the miner masquerading tradecraft seen in the AhsayCBS exploitation campaign.
references:
  - https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html
  - https://attack.mitre.org/techniques/T1036/
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.defense_evasion
  - attack.t1036
  - attack.impact
  - attack.t1496
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith:
      - '\msedge.exe'
      - '\MicrosoftEdge.exe'
      - '\msedgewebview2.exe'
  filter_legit_path:
    Image|startswith:
      - 'C:\Program Files (x86)\Microsoft\Edge\'
      - 'C:\Program Files\Microsoft\Edge\'
      - 'C:\Windows\SystemApps\'
  selection_args:
    CommandLine|contains:
      - 'stratum+tcp'
      - 'stratum+ssl'
      - '--donate-level'
      - '--coin='
      - '-o pool.'
      - '--tls'
      - '--cpu-priority'
  condition: (selection_name and not filter_legit_path) or (selection_name and selection_args)
falsepositives:
  - User-installed Edge variants in non-default directories (validate signer and hash before tuning)
level: critical
---
title: Web Shell File Written to AhsayCBS Web Application Directory
id: b47e5f21-6c8a-4d92-a1e3-5f7b9c0d2e4f
status: experimental
description: Detects creation of JSP, JSPX, or script files within AhsayCBS web application directories, consistent with web shell deployment following CVE-2026-105133 authentication bypass.
references:
  - https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\AhsayCBS\webapps\'
      - '\AhsayCBS\webapp\'
      - '\AhsayCBS\apache-tomcat\webapps\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.war'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate Ahsay product updates (correlate with vendor update windows and signed installers)
level: high

// Hunt 1: Edge-named binaries running outside legitimate paths, or with XMRig arguments
let legitEdgePaths = dynamic([@"C:\Program Files (x86)\Microsoft\Edge\", @"C:\Program Files\Microsoft\Edge\", @"C:\Windows\SystemApps\"]);
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("msedge.exe", "MicrosoftEdge.exe", "msedgewebview2.exe")
| extend IsLegitPath = FolderPath has_any (legitEdgePaths)
| extend MinerArgs = ProcessCommandLine has_any ("stratum+tcp", "stratum+ssl", "donate-level", "--coin=", "-o pool.")
| where IsLegitPath == false or MinerArgs == true
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, AccountName
| order by Timestamp desc;

// Hunt 2: Outbound connections from Edge-named or unsigned binaries to common mining pool ports
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemotePort in (3333, 4444, 5555, 7777, 8888, 9999, 14433, 45700)
| where InitiatingProcessFileName in~ ("msedge.exe", "MicrosoftEdge.exe", "xmrig.exe")
   or InitiatingProcessFolderPath has_any (@"\Temp\", @"\AppData\", @"\ProgramData\", @"\AhsayCBS\")
| summarize ConnectionCount = count(), RemoteIPs = make_set(RemoteIP, 10) by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemotePort
| order by ConnectionCount desc;

// Hunt 3: AhsayCBS Java service spawning shells or downloaders (web shell execution)
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "java.exe"
  and InitiatingProcessCommandLine has "ahsay"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName
| order by Timestamp desc;

-- Hunt for Edge-masquerading miners and stratum connections on AhsayCBS hosts
LET proc = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)msedge|MicrosoftEdge'
   AND Exe !~ '(?i)Program Files.\\Microsoft\\Edge'
   AND Exe !~ '(?i)SystemApps')
   OR CommandLine =~ '(?i)stratum\+tcp|stratum\+ssl|donate-level|--coin=|xmrig'

SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
       netstat(Pid=Pid) AS Connections
FROM proc

# AhsayCBS CVE-2026-105133 triage — run elevated on the backup server
$report = @{}

# 1) Locate AhsayCBS installation and capture version info for vendor comparison
$ahsayPaths = @("C:\Program Files\AhsayCBS", "C:\AhsayCBS", "D:\AhsayCBS")
$report.InstallPaths = $ahsayPaths | Where-Object { Test-Path $_ }
Write-Host "[+] AhsayCBS install paths found: $($report.InstallPaths -join ', ')"
Write-Host "[ACTION] Compare the installed build against the latest release at https://www.ahsay.com and upgrade immediately."

# 2) Hunt for Edge-named binaries outside legitimate locations
$edgeImpostors = Get-CimInstance Win32_Process |
  Where-Object { $_.Name -match '^(msedge|MicrosoftEdge|msedgewebview2)\.exe$' -and
                 $_.ExecutablePath -notmatch '^C:\\Program Files( \(x86\))?\\Microsoft\\Edge\\' -and
                 $_.ExecutablePath -notmatch '^C:\\Windows\\SystemApps\\' } |
  Select-Object ProcessId, Name, ExecutablePath, CommandLine
if ($edgeImpostors) { Write-Host "[!] SUSPICIOUS Edge-named processes found:"; $edgeImpostors | Format-List }

# 3) Check for XMRig-style command lines on any process
$minerArgs = Get-CimInstance Win32_Process |
  Where-Object { $_.CommandLine -match 'stratum\+tcp|stratum\+ssl|donate-level|--coin=|-o pool\.' } |
  Select-Object ProcessId, Name, ExecutablePath, CommandLine
if ($minerArgs) { Write-Host "[!] SUSPICIOUS mining arguments found:"; $minerArgs | Format-List }

# 4) Enumerate recent JSP/script writes in AhsayCBS web directories (web shell check)
foreach ($p in $report.InstallPaths) {
  Get-ChildItem -Path $p -Recurse -Include *.jsp,*.jspx,*.war -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-60) } |
    Select-Object FullName, LastWriteTime, CreationTime
}

# 5) Check active connections to common stratum/mining ports
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemotePort -in 3333,4444,5555,7777,8888,9999,14433,45700 } |
  Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess,
    @{n='ProcessName';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name}}

Write-Host "[+] Triage complete. If any [!] findings exist: isolate the host, preserve volatile evidence, rotate ALL credentials stored in or managed by AhsayCBS, and begin IR scoping."

# Check for Edge-masquerading or XMRig processes and stratum connections
ps auxww | grep -Ei 'xmrig|stratum\+|donate-level|msedge' | grep -v grep
ss -tulpn | grep -E ':(3333|4444|5555|7777|8888|9999|14433|45700)'

# Find recently modified web content in the AhsayCBS Tomcat/webapps tree (adjust install path)
find /usr/local/AhsayCBS -name '*.jsp' -o -name '*.war' 2>/dev/null | xargs ls -lt 2>/dev/null | head -40

# Review AhsayCBS service children for unexpected shells
pstree -ap $(pgrep -f ahsay | head -1)