Integrity Technology Group Email Theft Campaign: Detection and Hardening Guide for Defenders

---
title: Webshell Drop on Web or Mail Server Process
description: Detects web server or mail server worker processes writing script files to web-accessible directories, consistent with webshell deployment following web exploitation as described in the Integrity Technology Group campaign.
references:
  - https://thehackernews.com/2026/10/fbi-says-china-linked-hackers-ran.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/09
status: experimental
id: 3f9c1a72-8b44-4e19-a2d6-7c5e8f1a9b03
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\tomcat8.exe'
      - '\java.exe'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.asp'
      - '.ashx'
      - '.asmx'
      - '.jsp'
      - '.php'
  selection_path:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\ClientAccess\'
      - '\FrontEnd\HttpProxy\'
      - '\htdocs\'
      - '\www\'
  condition: selection_img and selection_ext and selection_path
falsepositives:
  - Legitimate application deployment pipelines writing web content
  - CMS administrative publishing activity
level: high
---
title: Web Server Process Spawning Command Shell
description: Detects web or mail server worker processes spawning command interpreters or scripting engines, a hallmark of post-exploitation via webshell or direct command injection against internet-facing applications.
references:
  - https://thehackernews.com/2026/10/fbi-says-china-linked-hackers-ran.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/09
status: experimental
id: 8d2e5b91-4c37-4f82-b6a1-9e3d7c2a5f18
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\tomcat8.exe'
      - '\php-cgi.exe'
      - '\UMWorkerProcess.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
      - '\ipconfig.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate application integrations; investigate parent application and command line
level: critical
---
title: Anomalous Logon to Mail Server from Unusual Source
description: Detects successful network logons to Exchange or mail infrastructure from non-interactive logon types outside expected service patterns, consistent with attacker access to mail services using compromised credentials.
references:
  - https://thehackernews.com/2026/10/fbi-says-china-linked-hackers-ran.html
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/10/09
status: experimental
id: b17a3e48-2d95-4c61-8f24-6a1b9d4e7c52
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  category: authentication
  product: windows
detection:
  selection:
    Logon_Type:
      - 3
      - 8
  filter_service_accounts:
    User|endswith: '$'
  filter_health_mailbox:
    User|startswith:
      - 'HealthMailbox'
      - 'SYSTEM'
  condition: selection and not filter_service_accounts and not filter_health_mailbox
falsepositives:
  - Normal OWA/EAS client authentication - baseline source IPs per mail server and alert on deviations
level: medium

// Hunt 1: Anomalous mailbox access patterns — bulk reads consistent with email harvesting
// Look for accounts accessing an abnormal volume of distinct mailboxes or items in short windows
OfficeActivity
| where TimeGenerated > ago(14d)
| where Operation in ("MailItemsAccessed", "MessageBind", "FolderBind")
| where RecordType == "ExchangeItem" or RecordType == "ExchangeItemAggregated"
| extend ClientIP = tostring(parse_json(ClientIP)), UserId = tostring(UserId)
| summarize
    Operations = count(),
    DistinctFolders = dcount(tostring(parse_json(Folders))),
    SourceIPs = make_set(ClientIP, 5)
    by UserId, bin(TimeGenerated, 1h)
| where Operations > 200 or DistinctFolders > 50
| project TimeGenerated, UserId, Operations, DistinctFolders, SourceIPs
| order by Operations desc;

// Hunt 2: Scanning and probing patterns against web/mail front-ends
// High request volume from single sources to auth/webmail paths, or 4xx burst behavior
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("/owa/", "/ecp/", "/ews/", "/autodiscover/", "/rpc/", "/api/")
| summarize
    Requests = count(),
    DistinctPaths = dcount(RequestURL),
    FailedResponses = countif(DeviceAction =~ "failure" or toint(AdditionalExtensions) between (400 .. 499))
    by SourceIP, bin(TimeGenerated, 10m)
| where Requests > 300 or (DistinctPaths > 40 and FailedResponses > 50)
| project TimeGenerated, SourceIP, Requests, DistinctPaths, FailedResponses
| order by Requests desc;

// Hunt 3: Webshell execution — web worker processes spawning shells (Defender for Endpoint)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "tomcat8.exe", "php-cgi.exe", "UMWorkerProcess.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "whoami.exe", "ipconfig.exe", "wscript.exe", "cscript.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

-- Hunt: Recently created script files in web-accessible directories (webshell triage)
-- Scope to Exchange ClientAccess and standard web roots; flag files created in the last 90 days
LET cutoff <= timestamp(epoch=now() - (90 * 24 * 3600))

SELECT FullPath,
       Mtime AS Modified,
       Ctime AS Created,
       Size,
       Btime AS BirthTime
FROM glob(globs=[
  'C:/inetpub/wwwroot/**/*.aspx',
  'C:/inetpub/wwwroot/**/*.asp',
  'C:/inetpub/wwwroot/**/*.ashx',
  'C:/Program Files/Microsoft/Exchange Server/*/ClientAccess/**/*.aspx',
  'C:/Program Files/Microsoft/Exchange Server/*/FrontEnd/HttpProxy/**/*.aspx',
  '/var/www/**/*.php',
  '/usr/share/nginx/**/*.php',
  '/opt/tomcat/webapps/**/*.jsp'
])
WHERE Created > cutoff OR BirthTime > cutoff
ORDER BY Created DESC

-- Corroborating hunt: web worker processes with unexpected child processes (live state)
SELECT Pid,
       Ppid,
       Name,
       CommandLine,
       Exe,
       Username,
       CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|net|whoami|wscript|cscript)'
  AND Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(?i)(w3wp|httpd|nginx|tomcat|php-cgi|UMWorkerProcess)')

# Exchange / web-facing mail infrastructure hardening audit
# Run elevated on the Exchange server. Review output before making changes.

$report = @()

# 1) Scan web-accessible directories for recently created/modified script files (webshell triage)
$webRoots = @(
    "$env:SystemDrive\inetpub\wwwroot",
    "$env:ExchangeInstallPath\ClientAccess",
    "$env:ExchangeInstallPath\FrontEnd\HttpProxy"
) | Where-Object { Test-Path $_ }

$cutoff = (Get-Date).AddDays(-90)
foreach ($root in $webRoots) {
    Get-ChildItem -Path $root -Recurse -Include *.aspx,*.asp,*.ashx,*.asmx -ErrorAction SilentlyContinue |
        Where-Object { $_.CreationTime -gt $cutoff -or $_.LastWriteTime -gt $cutoff } |
        ForEach-Object {
            $report += [PSCustomObject]@{
                Check   = 'RecentScriptFile'
                Path    = $_.FullName
                Created = $_.CreationTime
                Modified= $_.LastWriteTime
            }
        }
}

# 2) Audit non-default FullAccess mailbox permissions (bulk access = harvesting enabler)
Get-Mailbox -ResultSize Unlimited | Get-MailboxPermission |
    Where-Object {
        $_.AccessRights -match 'FullAccess' -and
        -not $_.IsInherited -and
        $_.User -notmatch 'NT AUTHORITY|HealthMailbox|S-1-5-'
    } | ForEach-Object {
        $report += [PSCustomObject]@{
            Check   = 'NonDefaultFullAccess'
            Path    = $_.Identity.ToString()
            Created = $_.User.ToString()
            Modified= ($_.AccessRights -join ',')
        }
    }

# 3) Check for ECP exposed externally (admin interface should be internal-only)
$ecp = Get-EcpVirtualDirectory -ErrorAction SilentlyContinue
foreach ($v in $ecp) {
    $report += [PSCustomObject]@{
        Check   = 'ECPVirtualDirectory'
        Path    = $v.Server + $v.Name
        Created = "ExternalUrl: $($v.ExternalUrl)"
        Modified= "AdminEnabled: $($v.AdminEnabled)"
    }
}

# 4) Verify IIS is not running world-writable content directories
foreach ($root in $webRoots) {
    $acl = Get-Acl $root
    $acl.Access | Where-Object {
        $_.IdentityReference -match 'Everyone|BUILTIN\\Users' -and
        $_.FileSystemRights -match 'Write|FullControl|Modify'
    } | ForEach-Object {
        $report += [PSCustomObject]@{
            Check   = 'WeakWebRootACL'
            Path    = $root
            Created = $_.IdentityReference.ToString()
            Modified= $_.FileSystemRights.ToString()
        }
    }
}

$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\ExchangeHardeningAudit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Write-Host "`nAudit complete. Review the CSV for webshell indicators, excessive mailbox permissions, and exposed ECP." -ForegroundColor Yellow