Helpdesk Zero-Day Exploitation, Rogue TLS Certificates, and AI-Evasive Malware: Defender's Playbook for the Week's Active Threats

---
title: Helpdesk Web Service Spawning Command Shells
id: 3f8c1a72-6b4d-4e91-a2c7-9d5e1f0b8a34
status: experimental
description: Detects helpdesk/ITSM web service processes (ManageEngine ServiceDesk Plus, Jira, Freshservice, generic Java/Node web tiers) spawning command interpreters — a hallmark of post-exploitation following web-tier zero-day compromise.
references:
  - https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/26
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\javaw.exe'
      - '\java.exe'
      - '\wrapper.exe'
      - '\node.exe'
      - '\tomcat9.exe'
      - '\servicedesk.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\curl.exe'
      - '\bitsadmin.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\net.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - ITSM platforms executing legitimate automation or mail-fetch scripts; baseline per-host and alert on deviation
level: high
---
title: Webshell Drop in Helpdesk Webroot
id: 7b2e9d41-3a5f-4c68-b8d1-2e6a0c4f9b17
status: experimental
description: Detects creation of script files (JSP, ASPX, PHP, WAR) in common helpdesk/ITSM webroot and webapp directories — consistent with webshell deployment following exploitation of an internet-facing helpdesk platform.
references:
  - https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/26
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\ManageEngine\ServiceDesk\'
      - '\Atlassian\JIRA\'
      - '\Tomcat\webapps\'
      - '\webapps\ROOT\'
      - '\inetpub\wwwroot\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.aspx'
      - '.ashx'
      - '.php'
      - '.war'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate application updates or custom plugin deployment; correlate with change windows
level: high
---
title: Execution of Binary Signed by Rare or Newly Observed Certificate
id: c4d1f6a8-8e2b-4d73-9a05-5f3c7e1b6d92
status: experimental
description: Detects signed executables launched from user-writable or temporary paths — a pattern consistent with malware leveraging fraudulently obtained or rogue code-signing certificates to bypass reputation controls. Pair with certificate issuer baselining.
references:
  - https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html
  - https://attack.mitre.org/techniques/T1553/002/
author: Security Arsenal
date: 2026/10/26
tags:
  - attack.defense_evasion
  - attack.t1553.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Downloads\'
    Image|endswith: '.exe'
  filter_known_paths:
    Image|contains:
      - '\AppData\Local\Microsoft\Teams\'
      - '\AppData\Local\slack\'
      - '\AppData\Roaming\Zoom\'
  condition: selection and not filter_known_paths
falsepositives:
  - User-mode installers and auto-updaters; suppress known enterprise updaters, investigate remaining signed binaries from low-prevalence publishers
level: medium

// Hunt 1: Helpdesk/ITSM web-tier processes spawning shells or downloaders (Defender for Endpoint)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("javaw.exe", "java.exe", "wrapper.exe", "node.exe", "tomcat9.exe", "servicedesk.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "curl.exe", "bitsadmin.exe", "mshta.exe", "whoami.exe", "net.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, InitiatingProcessFolderPath
| sort by TimeGenerated desc;

// Hunt 2: External connections TO helpdesk servers followed by outbound egress FROM them (Sentinel, CEF/Syslog ingest)
let HelpdeskHosts = dynamic(["helpdesk", "servicedesk", "itsm", "jira", "support"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any (HelpdeskHosts)
| where RemoteIPType == "Public"
| where InitiatingProcessFileName !in~ ("svchost.exe", "MsMpEng.exe", "lsass.exe")
| summarize Connections = count(), RemoteIPs = make_set(RemoteIP, 20), Ports = make_set(RemotePort, 20)
    by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where Connections > 0
| sort by TimeGenerated desc;

// Hunt 3: Rare signer / newly observed signed binaries from user paths (rogue cert abuse)
DeviceFileCertificateInfo
| where TimeGenerated > ago(14d)
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FolderPath has_any ("\\AppData\\", "\\Users\\Public\\", "\\ProgramData\\", "\\Temp\\")
    | where FileName endswith ".exe"
    | project DeviceName, FileName, SHA1, FolderPath, TimeGenerated
) on SHA1
| summarize FirstSeen = min(TimeGenerated1), Devices = dcount(DeviceName), Paths = make_set(FolderPath, 5)
    by Signer, SHA1, FileName
| where Devices <= 3
| sort by FirstSeen desc;

-- Hunt for suspicious child processes of helpdesk/ITSM service processes
-- Deploy as a multi-host hunt across servers identified as helpdesk/ITSM hosts
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)cmd\.exe|powershell\.exe|pwsh\.exe|certutil\.exe|curl\.exe|bitsadmin\.exe|mshta\.exe|whoami\.exe|net\.exe'
  AND Ppid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ '(?i)javaw|java|wrapper|node|tomcat|servicedesk'
  )

-- Hunt for recently written script files in common webroot/webapp paths (webshell triage)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Program Files/ManageEngine/ServiceDesk/**/*.jsp',
  'C:/Program Files/Atlassian/JIRA/**/*.jsp',
  'C:/Program Files/**/Tomcat*/webapps/**/*.jsp',
  'C:/inetpub/wwwroot/**/*.asp*'
])
WHERE Mtime > timestamp(epoch=now() - 604800)
ORDER BY Mtime DESC

-- Enumerate listening ports and owning processes on helpdesk hosts (unexpected listeners post-compromise)
SELECT Pid, Name, Status, Family, Type, LocalAddress, LocalPort, RemoteAddress, RemotePort
FROM netstat()
WHERE Status =~ 'LISTEN'
  AND Name !~ '(?i)system|svchost|sqlservr|java|tomcat|nginx|apache|httpd'

# helpdesk-hardening-audit.ps1 — run elevated on Windows-hosted ITSM/helpdesk servers
# Purpose: (1) identify child processes of web-tier services spawned in the last 7 days,
# (2) inventory recently written script files in webroots, (3) verify service account exposure.

Write-Host "=== [1] Suspicious child processes of web-tier services (7 days) ===" -ForegroundColor Cyan
$webParents = 'java','javaw','wrapper','node','tomcat9','servicedesk'
$suspiciousChildren = 'cmd','powershell','pwsh','certutil','curl','bitsadmin','mshta','whoami','net'
Get-CimInstance Win32_Process | ForEach-Object {
    $p = $_
    $parent = Get-CimInstance Win32_Process -Filter "ProcessId=$($p.ParentProcessId)" -ErrorAction SilentlyContinue
    if ($parent -and ($webParents -contains ($parent.Name -replace '\.exe$','')) -and
        ($suspiciousChildren -contains ($p.Name -replace '\.exe$',''))) {
        [PSCustomObject]@{
            Time       = $p.CreationDate
            Parent     = $parent.Name
            Child      = $p.Name
            Command    = $p.CommandLine
            User       = ($p | Invoke-CimMethod -MethodName GetOwner).User
        }
    }
} | Format-List

Write-Host "=== [2] Script files written to webroots in last 7 days (possible webshells) ===" -ForegroundColor Cyan
$webroots = @(
  'C:\Program Files\ManageEngine\ServiceDesk',
  'C:\Program Files\Atlassian\JIRA',
  'C:\inetpub\wwwroot'
) | Where-Object { Test-Path $_ }
foreach ($root in $webroots) {
    Get-ChildItem $root -Recurse -Include *.jsp,*.jspx,*.aspx,*.ashx,*.php,*.war -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
      Select-Object FullName, LastWriteTime, Length
}

Write-Host "=== [3] Helpdesk service account privilege check ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service |
  Where-Object { $_.DisplayName -match 'ServiceDesk|JIRA|Helpdesk|ITSM|Freshservice|Tomcat' } |
  Select-Object Name, DisplayName, StartName, State, PathName
# ACTION: If StartName is Domain Admin, SYSTEM-adjacent, or a highly privileged AD account,
# replace with a gMSA / least-privilege service account immediately.

Write-Host "=== [4] Outbound egress review — unexpected listeners ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Listen |
  Where-Object { $_.LocalPort -notin 80,135,139,443,445,3389,5985,5986 } |
  ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{ Port = $_.LocalPort; Process = $proc.ProcessName; Path = $proc.Path }
  } | Sort-Object Port -Unique | Format-Table -AutoSize