N-able N-central Unauthenticated RCE: Fourth Hotfix in Five Weeks — Detection, Patching, and Hardening Guide

---
title: N-central Application Spawning Command or Scripting Interpreter
id: 4f8c2a19-7d3e-4b61-a9f0-2c6e5d8a1b34
status: experimental
description: Detects the N-central server application (Java-based web tier or core services) spawning cmd.exe, PowerShell, or other scripting interpreters — a strong indicator of post-RCE command execution on the management host.
references:
  - https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\javaw.exe'
      - '\java.exe'
      - '\dsservice.exe'
      - '\ncentral.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - N-central legitimate automation may spawn cmd.exe for local server tasks — baseline the parent/child pairs on your build before hotfix application and alert on deviations
level: high
---
title: Webshell Drop in N-central Web Directory
id: 91b7e3d4-2a5f-4c88-b6d1-8e3f7a0c5d29
status: experimental
description: Detects creation of script files (ASPX, JSP, PHP) in N-central web application directories — consistent with webshell deployment following exploitation of the server web tier.
references:
  - https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Program Files (x86)\N-able\'
      - '\Program Files\N-able\'
      - '\N-central\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.jsp'
      - '.jspx'
      - '.php'
      - '.war'
  condition: selection_path and selection_ext
falsepositives:
  - N-central hotfix and upgrade installers legitimately write web application files — suppress by change window, not by path
level: critical

// Hunt: post-exploitation behavior on N-central servers
// Look for the N-central app tier spawning interpreters, and anomalous outbound connections
let ncentral_parents = dynamic(["javaw.exe", "java.exe", "dsservice.exe", "ncentral.exe", "apache.exe", "httpd.exe", "tomcat9.exe"]);
let interpreters = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "bitsadmin.exe", "certutil.exe", "curl.exe", "wget.exe"]);
union
(
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName in~ (ncentral_parents)
    | where FileName in~ (interpreters)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, ReportId
),
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName in~ (ncentral_parents)
    | where RemoteIPType == "Public"
    | where RemoteUrl !has_any ("n-able.com", "nable.com", "microsoft.com") // vendor update/telemetry endpoints
    | summarize ConnectionCount = count(), DistinctDestinations = dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
    | order by ConnectionCount desc
)
| order by TimeGenerated desc

-- N-central server compromise triage: child processes of the app tier and recent webshell-style file drops
LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(powershell|cmd\.exe|mshta|rundll32|certutil|bitsadmin|curl|wget)'

LET parent_lookup = SELECT Pid AS ParentPid, Name AS ParentName, Exe AS ParentExe FROM pslist()

LET suspect_children = SELECT p.Pid, p.Name, p.CommandLine, p.Username, p.CreateTime,
       par.ParentName, par.ParentExe
FROM procs p
JOIN parent_lookup par ON p.Ppid = par.ParentPid
WHERE par.ParentExe =~ '(?i)(javaw|java|dsservice|ncentral|tomcat|httpd|apache)\.exe'

LET web_drops = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Program Files (x86)/N-able/**/*.aspx',
  'C:/Program Files (x86)/N-able/**/*.jsp',
  'C:/Program Files/N-able/**/*.aspx',
  'C:/Program Files/N-able/**/*.jsp',
  'C:/**/N-central/**/*.jsp'
])
WHERE Mtime > now() - 1209600  -- modified in last 14 days

SELECT * FROM suspect_children
UNION ALL
SELECT NULL AS Pid, 'FILE_DROP' AS Name, FullPath AS CommandLine, NULL AS Username,
       Mtime AS CreateTime, NULL AS ParentName, NULL AS ParentExe FROM web_drops

# N-central Hotfix 4 verification and rapid triage
# Run elevated on the N-central server

$requiredBuild = [version]"2026.3.1.14"

# --- 1. Attempt to read installed N-central version from registry/uninstall entries ---
$uninstallPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$ncentral = Get-ItemProperty $uninstallPaths -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'N-central|N-able' } |
    Select-Object DisplayName, DisplayVersion

if ($ncentral) {
    $ncentral | Format-Table -AutoSize
    foreach ($entry in $ncentral) {
        try {
            $installed = [version]($entry.DisplayVersion -replace '[^0-9.]', '')
            if ($installed -lt $requiredBuild) {
                Write-Warning "VULNERABLE: $($entry.DisplayName) $installed < $requiredBuild — apply Hotfix 4 immediately"
            } else {
                Write-Host "OK: $($entry.DisplayName) $installed is at/above required build" -ForegroundColor Green
            }
        } catch {
            Write-Warning "Could not parse version for $($entry.DisplayName): $($entry.DisplayVersion) — verify manually in the N-central console (Help > About)"
        }
    }
} else {
    Write-Warning "N-central not found in uninstall registry — verify build manually via the N-central console (Help > About)"
}

# --- 2. Rapid triage: recent script/web files under N-able install paths (last 14 days) ---
$searchRoots = @('C:\Program Files (x86)\N-able', 'C:\Program Files\N-able') | Where-Object { Test-Path $_ }
foreach ($root in $searchRoots) {
    Get-ChildItem -Path $root -Recurse -Include *.aspx, *.ashx, *.jsp, *.jspx, *.php, *.war -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
        Select-Object FullName, LastWriteTime, Length |
        Sort-Object LastWriteTime -Descending |
        Format-Table -AutoSize
}

# --- 3. Flag suspicious child processes of the app tier from recent process creation logs (4688 with command line) ---
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4688; StartTime = (Get-Date).AddDays(-14) } -ErrorAction SilentlyContinue |
    ForEach-Object {
        $xml = [xml]$_.ToXml()
        $data = @{}
        foreach ($d in $xml.Event.EventData.Data) { $data[$d.Name] = $d.'#text' }
        if ($data['ParentProcessName'] -match '(?i)(javaw|java|dsservice|ncentral|tomcat|httpd)\.exe$' -and
            $data['NewProcessName'] -match '(?i)(cmd|powershell|pwsh|mshta|rundll32|certutil|bitsadmin|curl|wget)\.exe$') {
            [pscustomobject]@{
                TimeCreated = $_.TimeCreated
                Parent      = $data['ParentProcessName']
                Child       = $data['NewProcessName']
                CommandLine = $data['CommandLine']
            }
        }
    } | Format-List