Iran-Linked Hackers Sanctioned Over Critical Infrastructure Breaches — Detection and Hardening Guide for Defenders

---
title: IIS Worker Process Spawning Command Shell or Script Interpreter
id: 4c1f9a72-8d3e-4b6a-9f51-2a7c0e5d1188
status: experimental
description: Detects w3wp.exe (IIS worker process) spawning cmd, powershell, or other command interpreters — a high-fidelity indicator of webshell execution, consistent with Iran-nexus tradecraft against internet-facing web servers.
references:
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
      - '\ipconfig.exe'
      - '\nltest.exe'
  filter_legit_worker:
    CommandLine|contains: 'c:\windows\system32\inetsrv'
  condition: selection_parent and selection_child and not filter_legit_worker
falsepositives:
  - Rare legitimate web application management functions; investigate any hit rather than tuning broadly
level: high
---
title: Script File Creation in Web Server Root Directories
id: 9b2e7d41-5f0c-4a89-b6d3-7e1a4c8f2290
status: experimental
description: Detects creation of executable script files (ASPX, ASHX, PHP, JSP) in web server content directories — consistent with webshell deployment following compromise of an internet-facing web or Exchange server.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\wwwroot\'
      - '\ClientAccess\'
      - '\FrontEnd\HttpProxy\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.php'
      - '.jsp'
  filter_known_deployers:
    Image|endswith:
      - '\msiexec.exe'
      - '\setup.exe'
      - '\w3wp.exe'
  condition: selection_path and selection_ext and not filter_known_deployers
falsepositives:
  - Legitimate application deployments and content publishing; baseline deployment tooling and tune per-environment
level: high
---
title: PowerShell Download Cradle or Encoded Command Execution
id: 2f8a3c65-1d94-4e7b-a058-6b9d2f7c3314
status: experimental
description: Detects PowerShell execution with download cradles, encoded commands, or hidden window flags — living-off-the-land execution patterns used by Iran-nexus actors for payload staging and reconnaissance.
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cradle:
    CommandLine|contains:
      - 'DownloadString'
      - 'DownloadFile'
      - 'IEX'
      - 'Invoke-Expression'
      - 'Net.WebClient'
      - 'Start-BitsTransfer'
      - 'curl.exe'
  selection_flags:
    CommandLine|contains:
      - ' -enc'
      - ' -encodedcommand'
      - ' -w hidden'
      - ' -windowstyle hidden'
      - ' -nop'
  condition: selection_img and (selection_cradle or (selection_flags and selection_cradle))
falsepositives:
  - Administrative automation and software deployment scripts; scope alerting to servers and critical-infrastructure segments first
level: medium

// Hunt 1: Webshell execution — IIS worker process spawning shells or recon tooling
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "net1.exe",
                     "whoami.exe", "ipconfig.exe", "nltest.exe", "cscript.exe", "wscript.exe",
                     "rundll32.exe", "certutil.exe", "bitsadmin.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
          InitiatingProcessCommandLine, AccountName, ReportId
| order by TimeGenerated desc;

// Hunt 2: Password spray pattern — single source failing against many distinct accounts
// Works against AAD sign-in logs (SigninLogs) or Windows 4625 forwarded as SecurityEvent
SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType != "0"
| summarize FailedAccounts = dcount(UserPrincipalName),
            Attempts = count(),
            Apps = make_set(AppDisplayName),
            UserAgents = make_set(UserAgent)
  by IPAddress, bin(TimeGenerated, 1h)
| where FailedAccounts >= 20
| order by FailedAccounts desc;

// Windows variant via SecurityEvent (4625 failed logon)
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4625
| where LogonType in (3, 10)  // network / remote interactive — VPN, RDP, SMB sprays
| summarize DistinctAccounts = dcount(TargetUserName), Attempts = count()
  by IpAddress, bin(TimeGenerated, 1h)
| where DistinctAccounts >= 15
| order by DistinctAccounts desc;

// Hunt 3: Recent executable script files written to web roots (webshell staging)
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has_any ("inetpub\\wwwroot", "ClientAccess", "HttpProxy")
| where FileName endswith_any (".aspx", ".ashx", ".asmx", ".php")
| where ActionType == "FileCreated"
| project TimeGenerated, DeviceName, FolderPath, FileName,
          InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc;

-- Hunt for webshells and webshell-driven process execution on web servers
-- Part 1: Recently modified executable script files in IIS web roots
SELECT FullPath, Size, Mtime, Ctime,
       hash(path=FullPath) AS Hash
FROM glob(globs=[
  'C:/inetpub/wwwroot/**/*.aspx',
  'C:/inetpub/wwwroot/**/*.ashx',
  'C:/inetpub/wwwroot/**/*.asmx',
  'C:/Program Files/Microsoft/Exchange Server/**/ClientAccess/**/*.aspx',
  'C:/Program Files/Microsoft/Exchange Server/**/HttpProxy/**/*.aspx'
])
WHERE Mtime > now() - 1209600  -- last 14 days
ORDER BY Mtime DESC

-- Part 2: Processes spawned under IIS worker processes (active webshell execution)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'cmd|powershell|whoami|net |nltest|certutil|bitsadmin'
  AND Ppid IN (
    SELECT Pid FROM pslist() WHERE Name =~ 'w3wp'
  )

-- Part 3: Established outbound connections from web server processes
SELECT Pid, Name, Status, Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Status =~ 'ESTAB'
  AND Name =~ 'w3wp|powershell|cmd'
  AND Rport IN (443, 80, 8080, 8443)

# Iran-nexus webshell sweep and hardening verification — run elevated on web/Exchange servers
$report = @()

# 1. Sweep web roots for recently created/modified script files (potential webshells)
$webRoots = @('C:\inetpub\wwwroot',
              'C:\Program Files\Microsoft\Exchange Server')
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.aspx,*.ashx,*.asmx,*.php -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
            ForEach-Object {
                $hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
                $report += [pscustomobject]@{
                    Type='WebShellSuspect'; Path=$_.FullName;
                    Modified=$_.LastWriteTime; SHA256=$hash
                }
            }
    }
}

# 2. Check for IIS worker processes spawning shells right now
Get-CimInstance Win32_Process -Filter "Name='cmd.exe' OR Name='powershell.exe'" |
    Where-Object {
        $parent = Get-CimInstance Win32_Process -Filter "ProcessId=$($_.ParentProcessId)" -ErrorAction SilentlyContinue
        $parent.Name -eq 'w3wp.exe'
    } | ForEach-Object {
        $report += [pscustomobject]@{
            Type='ActiveShellUnderIIS'; Path=$_.CommandLine;
            Modified=$_.CreationDate; SHA256=''
        }
    }

# 3. Audit local Administrators for unexpected members (persistence check)
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
    ForEach-Object {
        $report += [pscustomobject]@{
            Type='LocalAdminMember'; Path=$_.Name; Modified=''; SHA256=''
        }
    }

# 4. Verify LSA protection and PowerShell logging (hardening baselines)
$lsa = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -ErrorAction SilentlyContinue
$report += [pscustomobject]@{
    Type='LSAProtection'; Path=($(if($lsa.RunAsPPL -eq 1){'ENABLED'}else{'DISABLED — set RunAsPPL=1'}));
    Modified=''; SHA256=''
}
$modLog = Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging' -Name EnableModuleLogging -ErrorAction SilentlyContinue
$report += [pscustomobject]@{
    Type='PSModuleLogging'; Path=($(if($modLog.EnableModuleLogging -eq 1){'ENABLED'}else{'DISABLED — enable via GPO'}));
    Modified=''; SHA256=''
}

$report | Format-Table -AutoSize
$report | Export-Csv "WebShellSweep_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation