Progress ShareFile Storage Zone Controllers: Urgent Shutdown and Active Threat Detection

---
title: ShareFile SZC Web Shell Activity - IIS Spawning Shell
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects the IIS worker process (w3wp.exe) spawning cmd.exe, powershell.exe, or other shells, indicative of web shell exploitation on ShareFile Storage Zone Controllers.
references:
  - Internal Advisory
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection
falsepositives:
  - Legitimate administrative scripts running via IIS (rare)
level: critical
---
title: Suspicious File Creation in ShareFile Web Root
title: Suspicious File Creation in ShareFile Web Root
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
status: experimental
description: Detects creation of common web shell extensions within the ShareFile Storage Zone Controller web directories.
references:
  - Internal Advisory
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_create
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\C:\inetpub\wwwroot\'
      - '\Program Files\Citrix\Storage Center\'
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.config'
  condition: selection
falsepositives:
  - legitimate software updates or installations
level: high

// Hunt for IIS worker process spawning suspicious children
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where ProcessFileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "regsvr32.exe", "rundll32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, ProcessFileName, FolderPath
| extend FullPath = FolderPath \
"\\" \
 ProcessFileName

// Hunt for recent ASPX/ASHX files modified in the last 3 days in web roots
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="C:/inetpub/wwwroot/**/*.aspx")
WHERE Mtime > now() - 3*24*3600

// Hunt for processes spawned by w3wp.exe
SELECT Pid, Ppid, Name, CommandLine, Exe
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ "w3wp.exe")
  AND Name IN ("cmd.exe", "powershell.exe", "pwsh.exe")

# Script to isolate ShareFile Storage Zone Controller and check for IOCs
# Requires Administrative Privileges

Write-Host "[+] Initiating Emergency Isolation for ShareFile SZC..." -ForegroundColor Cyan

# 1. Stop IIS Services to halt the web application
Write-Host "[+] Stopping IIS Services..." -ForegroundColor Yellow
Stop-Service -Name W3SVC -Force -ErrorAction SilentlyContinue
Stop-Service -Name WAS -Force -ErrorAction SilentlyContinue

# 2. Check for recent suspicious process creations linked to w3wp.exe (Event ID 4688)
Write-Host "[+] Checking Event Logs for suspicious process spawns (Last 24h)..." -ForegroundColor Yellow
$events = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue

if ($events) {
    $suspicious = $events | Where-Object { $_.Message -match 'w3wp.exe' -and $_.Message -match '(cmd.exe|powershell.exe|pwsh.exe)' }
    if ($suspicious) {
        Write-Host "[!] WARNING: Found suspicious process spawns by w3wp.exe:" -ForegroundColor Red
        $suspicious | Select-Object TimeCreated, Message | Format-List
    } else {
        Write-Host "[-] No suspicious w3wp.exe spawns found in logs." -ForegroundColor Green
    }
}

# 3. Identify recently created ASPX/ASHX files (potential webshells)
Write-Host "[+] Scanning for recently created web files (Last 48h)..." -ForegroundColor Yellow
$webRoots = @("C:\inetpub\wwwroot", "C:\Program Files\Citrix\Storage Center")

foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.aspx, *.ashx, *.asmx, *.config `
        | Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-48) } `
        | Select-Object FullName, LastWriteTime, Length `
        | Format-Table -AutoSize
    }
}

Write-Host "[+] Isolation complete. Keep the server offline until vendor patch is applied." -ForegroundColor Green