IABs Shift to High-Value Targets: Defending Gov, Retail, and IT Sectors

---
title: Suspicious Process Spawn by Web Server
id: 8a4c3e12-1d9b-4b5a-9c2d-3e4f5a6b7c8d
status: experimental
description: Detects web server processes spawning shells, indicative of web shell activity or exploitation.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2025/05/01
tags:
  - attack.execution
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate administrative maintenance via web interface
level: high
---
title: Suspicious Interactive RDP Session from External IP
id: 9b5d4f23-2e0c-5c6b-0d3e-4f5a6b7c8d9e
status: experimental
description: Detects successful RDP logons from external sources, common in IAB access sales involving VPN or RDP exploits.
references:
  - https://attack.mitre.org/techniques/T1076/
author: Security Arsenal
date: 2025/05/01
tags:
  - attack.initial_access
  - attack.t1076
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    EventID: 4624
    LogonType: 10
    SourceNetworkAddress|contains:
      - '-' # Exclude local/empty
falsepositives:
  - Legitimate remote administration by employees
level: medium

// Hunt for processes spawned by common web servers indicating potential web shells
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "java.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "bash.exe", "sh")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, CommandLine
| order by Timestamp desc

// Hunt for anomalous sign-ins from geographically distant locations typical of IAB usage
SigninLogs
| where Result == "success"
| where RiskDetail == "none" // Filtering out known high-risk to see what slips through
| extend LocationDetails = parse_(LocationDetails)
| project Timestamp, UserPrincipalName, AppDisplayName, IPAddress, LocationDetails.countryOrRegion, DeviceDetail.trustType
| order by Timestamp desc

-- Hunt for recently modified web artifacts that could indicate a web shell upload
SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs='C:/inetpub/wwwroot/**/*.asp')
WHERE Mtime < now() - 24h // Recently modified in last 24 hours

-- Hunt for suspicious network connections established by web servers
SELECT Pid, Name, RemoteAddr, RemotePort, State
FROM netstat()
WHERE Name IN ['w3wp.exe', 'httpd.exe', 'nginx.exe'] AND State == 'ESTABLISHED'

# PowerShell Script: Audit Recent Service Creations and Check for Web Shells
# Run as Administrator

Write-Host "Auditing for suspicious service creations in the last 7 days..."
$DateCutoff = (Get-Date).AddDays(-7)
$SuspiciousServices = Get-WmiObject Win32_Service | Where-Object { $_.InstallDate -and [DateTime]::ParseExact($_.InstallDate.Substring(0,8), "yyyyMMdd", $null) -gt $DateCutoff }

if ($SuspiciousServices) {
    Write-Host "[WARNING] Found services installed recently:" -ForegroundColor Yellow
    $SuspiciousServices | Select-Object Name, DisplayName, State, PathName, InstallDate
} else {
    Write-Host "[INFO] No suspicious recent services found." -ForegroundColor Green
}

Write-Host "Scanning web directories for common web shell extensions..."
$WebPaths = @("C:\inetpub\wwwroot", "C:\xampp\htdocs")
$SuspiciousExtensions = @(".asp", ".php", ".aspx", ".jsp")

foreach ($Path in $WebPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -Include $SuspiciousExtensions -ErrorAction SilentlyContinue | 
        Where-Object { $_.LastWriteTime -gt $DateCutoff } | 
        Select-Object FullName, LastWriteTime, Length
    }
}