$10M Reward for HAFNIUM Operator Zhang Yu: Defending Microsoft Exchange Against Silk Typhoon Tradecraft — Detection and Hardening Guide

---
title: IIS Worker Process Spawning Command Shell or PowerShell
id: 8f2c1a4b-3e5d-4f6a-9b7c-2d1e0a9f8c7b
status: experimental
description: Detects the Exchange IIS worker process (w3wp.exe) spawning cmd.exe, powershell.exe, or other script interpreters — a hallmark of China Chopper-style webshell execution observed in HAFNIUM/Silk Typhoon intrusions.
references:
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
  filter_owa_layouts:
    CommandLine|contains:
      - 'OABGen'
  condition: selection_parent and selection_child and not filter_owa_layouts
falsepositives:
  - Rare legitimate Exchange administrative tooling; validate against change windows
level: critical
---
title: Webshell Dropped to IIS or Exchange Web Directory
id: 4b7d9e2f-1a3c-4d5e-8f6b-0c9d2e1a3b4c
status: experimental
description: Detects creation of ASPX script files in Exchange/IIS web-accessible directories by non-standard processes — consistent with HAFNIUM arbitrary-file-write webshell deployment to aspnet_client and Exchange virtual directories.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\inetpub\wwwroot\aspnet_client\'
      - '\FrontEnd\HttpProxy\'
      - '\ClientAccess\'
      - '\wwwroot\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.asp'
      - '.ashx'
      - '.asmx'
  filter_installers:
    Image|endswith:
      - '\setup.exe'
      - '\msiexec.exe'
      - '\TiWorker.exe'
      - '\wuauclt.exe'
  condition: selection_path and selection_ext and not filter_installers
falsepositives:
  - Legitimate Exchange cumulative update installation; correlate with patch windows
level: high
---
title: LSASS Memory Dump via comsvcs.dll MiniDump
id: 6c1e8a3d-9b2f-4e7d-a5c6-3f8b0d2e4a6c
status: experimental
description: Detects credential dumping of LSASS memory using the built-in comsvcs.dll MiniDump export — a technique used by HAFNIUM/Silk Typhoon operators for post-compromise credential theft without dropping procdump.
references:
  - https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
      - 'comsvcs.dll'
      - 'MiniDump'
  condition: selection
falsepositives:
  - Very rare; some EDR/forensics tooling uses this technique — allowlist by signer and parent
level: critical

// Hunt: IIS worker process spawning shells or recon binaries (Exchange webshell behavior)
// Tables: Microsoft Defender for Endpoint process telemetry
let shell_binaries = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe", "net.exe", "net1.exe", "ipconfig.exe", "nltest.exe", "quser.exe", "rundll32.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ (shell_binaries)
| extend InitiatingCmd = InitiatingProcessCommandLine
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingCmd, AccountName, SHA256
| order by TimeGenerated desc
;
// Companion hunt: .aspx/.ashx file creation under IIS or Exchange web roots
DeviceFileEvents
| where TimeGenerated > ago(30d)
| where FolderPath has_any ("\\inetpub\\wwwroot\\", "\\aspnet_client\\", "\\FrontEnd\\HttpProxy\\", "\\ClientAccess\\")
| where FileName endswith ".aspx" or FileName endswith ".ashx" or FileName endswith ".asmx"
| where InitiatingProcessFileName !in~ ("TiWorker.exe", "msiexec.exe", "setup.exe", "w3wp.exe", "svchost.exe")
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc

-- Velociraptor hunt: enumerate recently created/modified script files in Exchange/IIS web roots
-- Deploy as a multi-client hunt across all Exchange servers. Review hits for small file size,
-- single-line content, or timestamps correlating with exposure windows.
LET webroots = glob(globs=['C:/inetpub/wwwroot/**/*.aspx',
  'C:/inetpub/wwwroot/aspnet_client/**/*.aspx',
  'C:/inetpub/wwwroot/**/*.ashx',
  'C:/Program Files/Microsoft/Exchange Server/V15/FrontEnd/HttpProxy/**/*.aspx'])
SELECT FullPath, Size, Mtime, Btime,
  read_file(filename=FullPath, length=300) AS FileHeader
FROM foreach(row=webroots)
WHERE Mtime > now() - 86400 * 90
  OR Size < 4096
ORDER BY Mtime DESC

# Exchange hygiene & residual-compromise verification script (run elevated on each Exchange server)
# 1) Report installed Exchange version and CU build — compare against the Microsoft
#    Exchange Server build number reference to confirm you are on a supported CU + latest SU
$exSetup = Get-Command ExSetup.exe -ErrorAction SilentlyContinue
if (Test-Path "$env:ExchangeInstallPath\bin\Microsoft.Exchange.Clients.Owa2.Server.dll") {
    $ver = (Get-Item "$env:ExchangeInstallPath\bin\Microsoft.Exchange.Clients.Owa2.Server.dll").VersionInfo
    Write-Output "Exchange build: $($ver.ProductVersion)"
}

# 2) Sweep IIS web roots for suspicious script files: recently modified or unusually small .aspx/.ashx
$roots = @("C:\inetpub\wwwroot", "$env:ExchangeInstallPath\FrontEnd\HttpProxy")
foreach ($root in $roots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.aspx,*.ashx,*.asmx,*.asp -ErrorAction SilentlyContinue |
            Where-Object { $_.Length -lt 4096 -or $_.LastWriteTime -gt (Get-Date).AddDays(-180) } |
            Select-Object FullName, Length, LastWriteTime, CreationTime |
            Format-Table -AutoSize
    }
}

# 3) Enumerate local admins and Exchange privileged groups for unauthorized accounts
Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue | Select-Object Name, ObjectClass
Get-ADGroupMember -Identity "Organization Admins" -ErrorAction SilentlyContinue | Select-Object Name, SamAccountName

# 4) Check for rogue scheduled tasks running as SYSTEM with script/shell actions
Get-ScheduledTask | Where-Object {
    $_.Principal.UserId -match 'SYSTEM' -and
    ($_.Actions.Execute -match 'powershell|cmd|wscript|cscript|rundll32')
} | Select-Object TaskName, TaskPath, @{n='Action';e={$_.Actions.Execute}}, @{n='Args';e={$_.Actions.Arguments}}

# 5) Verify Hybrid/OWA auth: list any unexpected virtual directory auth or external URLs changed from baseline
Get-OwaVirtualDirectory -Server $env:COMPUTERNAME | Select-Object Server, InternalUrl, ExternalUrl, BasicAuthentication, FormsAuthentication
Get-EcpVirtualDirectory -Server $env:COMPUTERNAME | Select-Object Server, ExternalUrl, AdminEnabled