CVE-2026-105133 & CVE-2026-105134: AhsayCBS Exploited to Deploy Web Shells and XMRig Miners — Detection and Remediation Guide

---
title: AhsayCBS Process Spawning Command Shell or Script Interpreter
id: 3f8a1c94-7b2e-4d5a-9c61-0e4f8a2b6d71
status: experimental
description: Detects the AhsayCBS Java/service process spawning cmd.exe, PowerShell, or shell interpreters, consistent with post-authentication-bypass command execution via CVE-2026-105133/CVE-2026-105134.
references:
  - https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\AhsayCBS\'
      - '\cbs\'
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
      - '\cbs.exe'
      - '\cbsr.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - AhsayCBS pre/post backup job scripts legitimately invoking cmd.exe or PowerShell — baseline scheduled job behavior and exclude known administrative script paths
level: high
---
title: Web Shell File Created in AhsayCBS Web Directory
id: 8c2d5e17-4a9b-4f38-b6c2-7d1e9a3f5b08
status: experimental
description: Detects creation of JSP or script files within AhsayCBS web-accessible directories, consistent with web shell deployment following exploitation of CVE-2026-105133/CVE-2026-105134.
references:
  - https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\AhsayCBS\webapps\'
      - '\AhsayCBS\webapp\'
      - '\AhsayCBS\tomcat\webapps\'
      - '\AhsayCBS\www\'
      - '\AhsayCBS\console\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.war'
      - '.aspx'
      - '.php'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate AhsayCBS updates deploying new web application files — correlate with scheduled maintenance windows and verified vendor installer processes
level: critical
---
title: XMRig Cryptocurrency Miner Execution
id: 1e6b9d42-3c7a-4e15-a84f-2b8c6d0e9a43
status: experimental
description: Detects execution artifacts of the XMRig Monero miner, observed being deployed on exploited AhsayCBS servers. Covers process names and common command-line arguments for mining pool configuration.
references:
  - https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.impact
  - attack.t1496
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith:
      - '\xmrig.exe'
      - '\xmrig-notls.exe'
  selection_cli:
    CommandLine|contains:
      - '--donate-level'
      - '--coin='
      - 'stratum+tcp://'
      - 'stratum+ssl://'
      - 'pool.minexmr'
      - 'xmrpool'
      - 'supportxmr'
      - '--randomx-mode'
  condition: selection_name or selection_cli
falsepositives:
  - None expected in enterprise environments; any hit warrants investigation
level: high

// Hunt: AhsayCBS post-exploitation — shell spawning, web shell drops, XMRig
let Lookback = 14d;
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe","curl.exe"]);
let MinerIndicators = dynamic(["xmrig","--donate-level","stratum+tcp://","stratum+ssl://","pool.minexmr","xmrpool","supportxmr"]);
union
(
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFolderPath has_any ("AhsayCBS", "\\cbs\\")
       or InitiatingProcessFileName has_any ("cbs", "java")
    | where FileName in~ (SuspiciousChildren)
    | project TimeGenerated, DeviceName, Hunt="AhsayCBS spawned shell/script interpreter",
              InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName has_any (MinerIndicators) or ProcessCommandLine has_any (MinerIndicators)
    | project TimeGenerated, DeviceName, Hunt="XMRig miner execution",
              InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
),
(
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where FolderPath has_all ("AhsayCBS") and FolderPath has_any ("webapps", "webapp", "tomcat", "www", "console")
    | where FileName endswith ".jsp" or FileName endswith ".jspx" or FileName endswith ".war"
        or FileName endswith ".aspx" or FileName endswith ".php"
    | project TimeGenerated, DeviceName, Hunt="Web shell file in AhsayCBS web directory",
              FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
)
| order by TimeGenerated desc;

// Linux AhsayCBS hosts via Syslog ingestion — shells spawned by java/cbs and miner indicators
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName in~ ("java", "cbs")
   or SyslogMessage has_any ("/bin/sh", "/bin/bash", "wget ", "curl ", "xmrig", "stratum+tcp")
| where SyslogMessage has_any ("AhsayCBS", "xmrig", "stratum+tcp", "/bin/sh", "/bin/bash")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

-- AhsayCBS compromise triage: shells spawned by service, web shell drops, miner processes
LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(cmd\.exe|powershell|wscript|mshta|certutil|bitsadmin|xmrig|stratum\+tcp|donate-level)'
   OR Name =~ '(?i)(xmrig|cmd\.exe|powershell\.exe)'

LET webshells = SELECT FullPath AS ShellPath, Size, Mtime AS Modified
FROM glob(globs=['C:/AhsayCBS/webapps/**/*.jsp', 'C:/AhsayCBS/webapps/**/*.jspx',
                 'C:/AhsayCBS/**/webapps/**/*.war', 'C:/AhsayCBS/www/**/*.jsp',
                 '/opt/ahsaycbs/webapps/**/*.jsp', '/usr/local/ahsaycbs/webapps/**/*.jsp'],
          accessor='auto')
WHERE Modified > (now() - 30 * 24 * 3600)

LET conns = SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE RemotePort IN (3333, 4444, 5555, 7777, 14444)
   OR RemoteAddress =~ '(?i)(minexmr|xmrpool|supportxmr|nanopool|hashvault)'

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'WEBSHELL_FILE' AS Name, ShellPath AS CommandLine,
       NULL AS Exe, NULL AS Username, Modified AS CreateTime FROM webshells
UNION ALL
SELECT Pid, NULL AS Ppid, 'MINER_CONNECTION: ' + Name AS Name,
       RemoteAddress + ':' + RemotePort AS CommandLine, NULL AS Exe, NULL AS Username, NULL AS CreateTime FROM conns

# AhsayCBS CVE-2026-105133 / CVE-2026-105134 verification and triage script
# Run elevated. Read-only: collects evidence, does not remediate.

$Report = @()

# 1. Verify AhsayCBS installation and version
$cbsPath = "C:\Program Files\AhsayCBS"
if (-not (Test-Path $cbsPath)) { $cbsPath = "C:\AhsayCBS" }
if (Test-Path $cbsPath) {
    $ver = Get-ChildItem $cbsPath -Recurse -Filter "*.properties" -ErrorAction SilentlyContinue |
           Select-String -Pattern "version" -ErrorAction SilentlyContinue | Select-Object -First 5
    $Report += "[INFO] AhsayCBS found at $cbsPath"
    $Report += $ver | ForEach-Object { "[INFO] $($_.Line)" }
} else {
    $Report += "[WARN] AhsayCBS not found in default paths - verify install location"
}

# 2. Scan web directories for recently modified script files (potential web shells)
$webDirs = @("$cbsPath\webapps", "$cbsPath\webapp", "$cbsPath\www", "$cbsPath\console")
foreach ($dir in $webDirs) {
    if (Test-Path $dir) {
        Get-ChildItem $dir -Recurse -Include *.jsp,*.jspx,*.war,*.aspx,*.php -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
        ForEach-Object { $Report += "[ALERT] Recently modified web file: $($_.FullName) ($($_.LastWriteTime))" }
    }
}

# 3. Check for miner processes and suspicious children of AhsayCBS services
Get-Process | Where-Object { $_.Name -match 'xmrig|minerd|cryptonight' } |
    ForEach-Object { $Report += "[ALERT] Miner process running: $($_.Name) PID $($_.Id) Path $($_.Path)" }

# 4. Check persistence locations commonly abused by miner/web-shell campaigns
$runKeys = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
           "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run"
foreach ($key in $runKeys) {
    Get-ItemProperty $key -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'xmrig|AppData|Temp' } |
        ForEach-Object { $Report += "[ALERT] Suspicious Run key: $($_.Name) = $($_.Value)" }
    }
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'powershell|cmd|xmrig' -and
    $_.Actions.Arguments -match 'EncodedCommand|stratum|donate' } |
    ForEach-Object { $Report += "[ALERT] Suspicious scheduled task: $($_.TaskName)" }

# 5. Check listening ports for unexpected services
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalPort -notin 80,443,135,445,3389,5985,8443 } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        $Report += "[INFO] Listener $($_.LocalPort) -> $($proc.Name) ($($proc.Path))"
    }

$Report | Out-File "C:\AhsayCBS_Triage_$(Get-Date -Format yyyyMMdd_HHmm).txt"
$Report
Write-Host "`nTriage complete. Review ALERT lines, then apply the latest AhsayCBS build per vendor advisory."