HSIN Breach Analysis: Defending Trusted Information Sharing Environments

---
title: Web Server Process Spawning Command Shell
id: 9a1a2b3c-4d5e-6f78-90ab-cdef12345678
status: experimental
description: Detects web server processes spawning command shells (cmd.exe, powershell.exe, bash). This is a strong indicator of web shell activity.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.persistence
  - attack.web_shell
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate administrative debugging (rare in production)
level: critical
---
title: Potential Data Exfiltration via Web Server
id: b2c3d4e5-6f78-90ab-cdef-1234567890ab
status: experimental
description: Detects large data uploads from web server processes, potential staging or exfiltration activity.
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Image|contains:
      - 'w3wp.exe'
      - 'java.exe' 
    DestinationPort:
      - 443
      - 80
  filter:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
      - '172.16.0.0/12'
  condition: selection and not filter
falsepositives:
  - Legitimate high-volume traffic to known CDN endpoints
level: high

// Hunt for Web Shell Activity on Windows Servers
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("w3wp.exe", "httpd.exe", "nginx.exe")
| where FileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessId
| order by Timestamp desc

// Hunt for Suspicious Authentication Patterns (Failures followed by Success)
let TimeFrame = 1h;
SigninLogs
| where Timestamp > ago(3d)
| where ResultType == "50125" // Invalid password or username
| summarize FailedCount = count() by UserPrincipalName, IPAddress
| join kind=inner (
    SigninLogs
    | where Timestamp > ago(3d)
    | where ResultType == 0 // Success
    | project SuccessTime = Timestamp, UserPrincipalName, IPAddress, AppDisplayName
) on UserPrincipalName, IPAddress
| where FailedCount > 5 and SuccessTime > ago(TimeFrame)
| project SuccessTime, UserPrincipalName, IPAddress, AppDisplayName, FailedCount
| order by SuccessTime desc

-- Hunt for suspicious processes spawned by web servers
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ "w3wp" OR Name =~ "httpd" OR Name =~ "nginx")
  AND (Name =~ "cmd" OR Name =~ "powershell" OR Name =~ "bash" OR Name =~ "sh")

<#
.SYNOPSIS
    Audits web directories for potential web shell indicators.
.DESCRIPTION
    Scans IIS web root directories for files modified in the last 24 hours 
    that contain script keywords, aiding in the detection of compromised servers.
#>

$DateThreshold = (Get-Date).AddDays(-1)
$WebRoots = @("C:\inetpub\wwwroot", "C:\inetpub\wwwroot\HSIN_Portal") # Add custom paths
$SuspiciousKeywords = @("System.Diagnostics.Process.Start", "eval(base64_decode", "Invoke-Expression", "Request.BinaryRead")

Write-Host "[+] Starting Web Shell Audit Scan..." -ForegroundColor Cyan

foreach ($Root in $WebRoots) {
    if (Test-Path $Root) {
        Write-Host "[+] Scanning directory: $Root" -ForegroundColor Yellow
        
        Get-ChildItem -Path $Root -Recurse -File -ErrorAction SilentlyContinue | 
        Where-Object { $_.LastWriteTime -gt $DateThreshold } | 
        ForEach-Object {
            $Content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
            foreach ($Keyword in $SuspiciousKeywords) {
                if ($Content -match $Keyword) {
                    Write-Host "[!] SUSPICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
                    Write-Host "    - Contains Keyword: $Keyword" -ForegroundColor DarkGray
                    Write-Host "    - Last Modified: $($_.LastWriteTime)" -ForegroundColor DarkGray
                }
            }
        }
    } else {
        Write-Host "[-] Directory not found: $Root" -ForegroundColor Gray
    }
}

Write-Host "[+] Audit Complete." -ForegroundColor Cyan