CVE-2026-61500: Rejetto HFS Session Forgery Under Active Exploitation — Detection, Hunting, and Remediation Guide

---
title: Rejetto HFS Process Spawning Command Shell or Script Interpreter
id: 3f8a1c94-7b2e-4d51-9a06-c1e2f3a4b5c6
status: experimental
description: Detects the Rejetto HTTP File Server process (hfs.exe or node running HFS) spawning command shells, PowerShell, or other script interpreters — consistent with post-exploitation following CVE-2026-61500 admin session forgery and code execution.
references:
  - https://thehackernews.com/2026/10/attackers-target-rejetto-hfs-flaw-that.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/24
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\hfs.exe'
      - '\node.exe'
    ParentCommandLine|contains:
      - 'hfs'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - HFS admin-configured "run program on event" actions (document and allowlist explicitly)
  - Legitimate Node tooling in development environments — restrict to production HFS hosts
level: high
---
title: Suspicious Reconnaissance or Execution Tooling Launched Under HFS Service Context
id: 8b2d5e17-4c6a-4f89-b3d1-9e0a2c4f6d78
status: experimental
description: Detects discovery and staging commands (whoami, ipconfig, systeminfo, archive creation, base64-encoded commands) executed with a parent process chain rooted in the HFS server, indicating hands-on-keyboard activity after CVE-2026-61500 exploitation.
references:
  - https://thehackernews.com/2026/10/attackers-target-rejetto-hfs-flaw-that.html
  - https://attack.mitre.org/techniques/T1033/
  - https://attack.mitre.org/techniques/T1059.001/
author: Security Arsenal
date: 2026/10/24
tags:
  - attack.discovery
  - attack.t1033
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\hfs.exe'
      - '\node.exe'
  selection_cli:
    CommandLine|contains:
      - 'whoami'
      - 'systeminfo'
      - 'ipconfig /all'
      - '-enc '
      - '-encodedcommand'
      - 'FromBase64String'
      - 'Invoke-WebRequest'
      - 'Invoke-Expression'
      - 'downloadstring'
      - 'certutil -decode'
      - 'tar.exe -'
      - 'Compress-Archive'
  condition: selection_parent and selection_cli
falsepositives:
  - Rare; HFS does not normally execute discovery or download commands
level: critical
---
title: Potential HFS Session Key Brute-Force or Admin API Probing
id: 1c4e7a26-9d3b-4e58-a7c2-5f1b8d3e9a04
status: experimental
description: Detects high-volume or repeated requests against Rejetto HFS API and admin endpoints from a single source, consistent with session key guessing or forged-session validation attempts against CVE-2026-61500. Apply to web/proxy/firewall logs ingested into a SIEM.
references:
  - https://thehackernews.com/2026/10/attackers-target-rejetto-hfs-flaw-that.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/24
tags:
  - attack.initial_access
  - attack.t1190
  - attack.credential_access
  - attack.t1110
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/~/api/'
      - '/~/admin'
      - '/~/login'
  condition: selection_uri
falsepositives:
  - Legitimate admin usage — baseline admin source IPs and alert on deviation; tune thresholds to your environment
level: medium

// Part 1: Web-layer hunt — probing or key-guessing against HFS API/admin endpoints
// Requires HFS fronted by a proxy/firewall shipping CEF/Syslog to Sentinel
let HfsEndpoints = dynamic(["/~/api/", "/~/admin", "/~/login"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any (HfsEndpoints)
| summarize
    RequestCount = count(),
    DistinctURIs = dcount(RequestURL),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    URIs = make_set(RequestURL, 25)
  by SourceIP, DestinationHostName, DestinationPort
| where RequestCount > 20 or DistinctURIs > 5
| order by RequestCount desc;
// Part 2: Host-layer hunt — HFS or node spawning shells/script interpreters (Defender for Endpoint)
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("hfs.exe", "node.exe")
   or InitiatingProcessCommandLine has "hfs"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
    "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe",
    "curl.exe", "wget.exe", "whoami.exe", "net.exe")
| project TimeGenerated, DeviceName, AccountName,
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc;
// Part 3: Network connections from the HFS process to rare external destinations
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("hfs.exe", "node.exe")
| where RemoteIPType == "Public"
| summarize Connections = count(), Ports = make_set(RemotePort),
    FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by DeviceName, RemoteIP, RemoteUrl
| order by Connections asc; // low-volume egress from a file server is the anomaly

-- Hunt: Rejetto HFS (hfs.exe / node) suspicious child processes and egress
-- Deploy as a hunt across all endpoints hosting file-sharing services
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
       Ppid
FROM pslist()
WHERE Name =~ '(?i)hfs|node'
   OR CommandLine =~ '(?i)hfs'

-- Child processes of any HFS/node parent (code execution indicator)
SELECT child.Pid AS ChildPid,
       child.Name AS ChildName,
       child.CommandLine AS ChildCommandLine,
       child.Username AS ChildUser,
       parent.Pid AS ParentPid,
       parent.Name AS ParentName,
       parent.CommandLine AS ParentCommandLine
FROM pslist() AS child
JOIN pslist() AS parent ON child.Ppid = parent.Pid
WHERE parent.Name =~ '(?i)hfs|node'
  AND child.Name =~ '(?i)cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|whoami|net\.exe|sh|bash|python|perl'

-- Active network connections held by the HFS process (C2 / exfil review)
SELECT Pid, Name, LocalAddress, LocalPort, RemoteAddress, RemotePort, State
FROM netstat()
WHERE Name =~ '(?i)hfs|node'

# Rejetto HFS compromise triage — run elevated on the HFS host
# 1. Locate running HFS processes and their versions
$hfs = Get-Process | Where-Object { $_.Name -match '^(hfs|node)$' } |
  Select-Object Id, Name, Path, StartTime,
    @{N='CommandLine';E={(Get-CimInstance Win32_Process -Filter "ProcessId=$($_.Id)").CommandLine}}
$hfs | Format-List

# 2. Any child processes spawned by HFS (post-exploitation indicator)
foreach ($p in $hfs) {
  Get-CimInstance Win32_Process -Filter "ParentProcessId=$($p.Id)" |
    Select-Object ProcessId, Name, CommandLine, CreationDate | Format-List
}

# 3. HFS config & account review (HFS 3 stores config under the working directory)
#    Look for unexpected admin accounts or plugins added recently
Get-ChildItem -Path "C:\Program Files\hfs","$env:USERPROFILE\hfs",".\" -Recurse -Include config.yaml,*.yaml -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
  Select-Object FullName, LastWriteTime

# 4. Recent outbound connections from the HFS process
foreach ($p in $hfs) {
  Get-NetTCPConnection -OwningProcess $p.Id -ErrorAction SilentlyContinue |
    Where-Object { $_.State -eq 'Established' -and $_.RemoteAddress -notmatch '^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)' } |
    Select-Object RemoteAddress, RemotePort, State
}

# Linux equivalent for HFS 3 (Node) hosts — run as root
# 1. Find the HFS/node process and its command line
ps -eo pid,ppid,user,lstart,cmd | grep -Ei 'hfs|node' | grep -v grep

# 2. Enumerate children of the HFS process (shells, downloaders = red flag)
for pid in $(pgrep -f 'hfs|node'); do
  echo "=== Children of PID $pid ==="
  ps --ppid "$pid" -o pid,user,lstart,cmd
done

# 3. Recent config changes (new admin accounts / plugins)
find /opt/hfs /srv/hfs ~/hfs -name '*.yaml' -mtime -30 -ls 2>/dev/null

# 4. Outbound connections from the HFS process
for pid in $(pgrep -f 'hfs|node'); do
  ss -tnp | grep "pid=$pid"
done