European Retail Cyber Incidents: Detection and Hardening Guide for Retail Security Teams

---
title: Web Server Process Spawning Shell - Possible E-Commerce Compromise
id: 8f2c4a17-3b6e-4d91-a752-9c1e5f8b2d40
status: experimental
description: Detects web server or PHP processes spawning command shells, consistent with web shell deployment on e-commerce platforms following retail intrusions.
references:
  - https://www.infosecurity-magazine.com/news/retail-firms-confirm-cyber/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\php.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\net.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate application functionality; investigate all hits on internet-facing servers
level: high
---
title: LSASS Memory Access - Credential Dumping on Retail Systems
id: 2d7b9e45-1a8f-4c32-b654-7e3d6a9f1c58
status: experimental
description: Detects non-system processes accessing LSASS memory, a hallmark of credential theft preceding lateral movement to POS controllers and database servers.
references:
  - https://www.infosecurity-magazine.com/news/retail-firms-confirm-cyber/
  - https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1438'
      - '0x143a'
  filter_legitimate:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\svchost.exe'
      - '\wininit.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - EDR and backup agents; baseline your security tooling and add to the filter
level: high
---
title: Checkout JavaScript Modified Outside Deployment Window - Possible Skimmer Injection
id: 6e4a1c93-8d27-4f56-b381-4c9e2d7a5f60
status: experimental
description: Detects modification of JavaScript files in web content directories by processes other than approved deployment tooling, consistent with Magecart-style skimmer injection.
references:
  - https://www.infosecurity-magazine.com/news/retail-firms-confirm-cyber/
  - https://attack.mitre.org/techniques/T1189/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1189
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: '.js'
    TargetFilename|contains:
      - '\wwwroot\'
      - '\htdocs\'
      - '\public\'
      - '\static\'
      - '\checkout\'
  filter_deploy:
    Image|endswith:
      - '\msdeploy.exe'
      - '\dotnet.exe'
      - '\node.exe'
      - '\git.exe'
  condition: selection and not filter_deploy
falsepositives:
  - CMS admin panel edits and CI/CD pipelines; tune the filter to your deployment toolchain
level: high

// Hunt: Retail intrusion indicators - web shells, LSASS access, anomalous logons
let WebServers = dynamic(["w3wp.exe", "httpd.exe", "nginx.exe", "php-cgi.exe", "php.exe", "node.exe"]);
let ShellTools = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "whoami.exe", "nltest.exe", "dsquery.exe"]);
let WebShellActivity =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName in~ (WebServers)
    | where FileName in~ (ShellTools)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
    | extend Indicator = "Web server spawned shell";
let LSASSAccess =
    DeviceEvents
    | where TimeGenerated > ago(7d)
    | where ActionType == "OpenProcessApiCall"
    | where FileName =~ "lsass.exe"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
    | extend Indicator = "Suspicious LSASS handle access";
let AnomalousLogons =
    SigninLogs
    | where TimeGenerated > ago(7d)
    | where ResultType != 0
    | summarize FailedAttempts = count(), DistinctUsers = dcount(UserPrincipalName), Users = make_set(UserPrincipalName, 20) by IPAddress, AppDisplayName, bin(TimeGenerated, 1h)
    | where FailedAttempts > 20 or DistinctUsers > 10
    | extend Indicator = "Password spray / brute force pattern";
WebShellActivity
| union LSASSAccess, AnomalousLogons
| sort by TimeGenerated desc

// Hunt: Outbound connections from e-commerce servers to rare destinations
let WebServerIPs =
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "node.exe", "php-cgi.exe")
    | summarize by DeviceName;
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where DeviceName in (WebServerIPs)
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), DistinctRemoteIPs = dcount(RemoteIP) by RemoteUrl, DeviceName
| where ConnectionCount < 5  // rare destinations from servers that should talk to known payment/CDN endpoints
| join kind=leftanti (
    DeviceNetworkEvents
    | where TimeGenerated between (ago(30d) .. ago(7d))
    | summarize by RemoteUrl
) on RemoteUrl  // only destinations NOT seen in the prior 3-week baseline
| sort by ConnectionCount asc

-- Retail intrusion hunt: web content tampering and suspicious process lineage
-- Targets injected skimmers and web shells on e-commerce infrastructure
LET web_content = SELECT
    FullPath,
    Mtime,
    Size,
    hash(path=FullPath) AS Hash
FROM glob(
    globs=[
        'C:/inetpub/wwwroot/**/*.js',
        'C:/inetpub/wwwroot/**/*.php',
        'C:/inetpub/wwwroot/**/checkout*',
        '/var/www/**/*.js',
        '/var/www/**/*.php',
        '/srv/www/**/*.js'
    ]
)
WHERE Mtime > now() - 604800  -- modified in last 7 days

LET suspicious_procs = SELECT
    Pid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime
FROM pslist()
WHERE CommandLine =~ 'base64|FromBase64|IEX|Invoke-Expression|certutil|curl.*http|wget.*http'
   OR Exe =~ 'wwwroot|htdocs|/tmp/|/dev/shm/|AppData\\\\Local\\\\Temp'

SELECT * FROM web_content
UNION ALL
SELECT * FROM suspicious_procs

# Retail Intrusion Readiness Audit - E-Commerce / Web Tier
# Run elevated. Read-only: no system changes are made.

$report = @()
$webRoots = @("C:\inetpub\wwwroot")
$lookback = (Get-Date).AddDays(-14)

# 1. Recently modified script/content files in web roots
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.js,*.php,*.aspx,*.asp,*.config -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt $lookback } |
            ForEach-Object {
                $report += [pscustomobject]@{
                    Check   = 'RecentWebContentModification'
                    Path    = $_.FullName
                    Detail  = "Modified $($_.LastWriteTime)"
                    Severity = 'Review'
                }
            }
    }
}

# 2. Unsigned or anomalous scripts in web roots
Get-ChildItem -Path $webRoots -Recurse -Include *.ps1,*.bat,*.cmd,*.vbs -ErrorAction SilentlyContinue |
    ForEach-Object {
        $report += [pscustomobject]@{
            Check    = 'ScriptInWebRoot'
            Path     = $_.FullName
            Detail   = 'Executable script present in web content directory'
            Severity = 'High'
        }
    }

# 3. Newly created local administrators (credential-based intrusion indicator)
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | ForEach-Object {
    $report += [pscustomobject]@{
        Check    = 'LocalAdminMembership'
        Path     = $_.Name
        Detail   = 'Verify this account is expected and managed'
        Severity = 'Review'
    }
}

# 4. Services running from suspicious paths
Get-CimInstance Win32_Service |
    Where-Object { $_.PathName -match 'Temp|AppData|ProgramData|Users\\Public' } |
    ForEach-Object {
        $report += [pscustomobject]@{
            Check    = 'SuspiciousServicePath'
            Path     = $_.Name
            Detail   = $_.PathName
            Severity = 'High'
        }
    }

# 5. SMB signing and NTLMv1 posture (lateral movement resistance)
$smbServer = Get-SmbServerConfiguration
$report += [pscustomobject]@{
    Check    = 'SMBSigningRequired'
    Path     = 'SMB Server'
    Detail   = "RequireSecuritySignature = $($smbServer.RequireSecuritySignature)"
    Severity = if ($smbServer.RequireSecuritySignature) { 'Pass' } else { 'High' }
}
$ntlm = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name LmCompatibilityLevel -ErrorAction SilentlyContinue
$report += [pscustomobject]@{
    Check    = 'NTLMLevel'
    Path     = 'HKLM Lsa'
    Detail   = "LmCompatibilityLevel = $($ntlm.LmCompatibilityLevel) (5 = NTLMv2 only)"
    Severity = if ($ntlm.LmCompatibilityLevel -ge 5) { 'Pass' } else { 'Medium' }
}

$report | Sort-Object Severity, Check | Format-Table -AutoSize
$report | Export-Csv -Path ".\RetailReadinessAudit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Write-Host "Audit complete. Review all 'High' findings immediately." -ForegroundColor Yellow