Defending Against Critical IGL-Technologies eParking.fi Vulnerabilities (CVSS 9.4) in EV Charging Infrastructure

---
title: Potential Web Shell Creation in Web Directories
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the creation of suspicious files in common web directories which may indicate web shell upload following exploitation of authentication vulnerabilities.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-07
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\\inetpub\\wwwroot\\'
      - '\\wwwroot\\'
      - '\\htdocs\\'
    TargetFilename|endswith:
      - '.aspx'
      - '.asp'
      - '.php'
  condition: selection
falsepositives:
  - Legitimate administrative software updates
  - Legitimate web application development
level: high
---
title: Web Server Process Spawning System Shell
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects web server processes spawning cmd.exe or powershell.exe, often indicative of successful Remote Code Execution (RCE) or authentication bypass exploitation.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-07
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\\w3wp.exe'
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\java.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate administrative scripts run by developers
  - Server management tools
level: critical

// Hunt for excessive failed login attempts (Brute Force)
// Adjust the 'ServiceName' or 'TargetUserName' based on your specific eParking.fi logs if ingested
SigninLogs
| where ResultType == "50126" or ResultType == "50053" // Failure codes example
| summarize count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 5m)
| where count_ > 5
| project TimeGenerated, UserPrincipalName, IPAddress, count_
| order by TimeGenerated desc


// Detect successful administrative logins from unfamiliar locations or devices
// This helps identify unauthorized administrative control gained via auth bypass
DeviceLogonEvents
| where ActionType == "LogonSuccess" and LogonType == "10" // RemoteInteractive
| extend OSVer = tostring(OSVersion)
| project Timestamp, AccountName, AccountDomain, DeviceName, RemoteIP, RemoteDeviceName
| order by Timestamp desc

-- Hunt for recently modified ASPX/PHP files in web directories
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs='C:\\inetpub\wwwroot\**\*.aspx')
  OR glob(globs='C:\\inetpub\wwwroot\**\*.php')
WHERE Mtime > timestamp(now) - 3600
   OR Size < 5  -- Detect tiny web shells

-- Hunt for processes spawned by IIS worker processes
SELECT Name, Pid, Ppid, Exe, CommandLine, StartTime
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ "w3wp")
  AND Name =~ "(cmd|powershell|pwsh)"

<#
.SYNOPSIS
    Audit local users for suspicious creation dates.
.DESCRIPTION
    Checks for local user accounts created recently or with suspicious characteristics.
#>

$CutoffDate = (Get-Date).AddDays(-7)
$SuspiciousUsers = Get-LocalUser | Where-Object { $_.LastLogon -gt $CutoffDate -or $_.PasswordLastSet -gt $CutoffDate }

if ($SuspiciousUsers) {
    Write-Host "[!] Potential unauthorized user activity detected:" -ForegroundColor Red
    $SuspiciousUsers | Format-Table Name, PrincipalSource, LastLogon, PasswordLastSet, Enabled
} else {
    Write-Host "[+] No suspicious local user accounts found within the last 7 days." -ForegroundColor Green
}