Suo5 HTTP/HTTPS Tunneling via Compromised IIS Web Servers: OTX Pulse Analysis — Pivot Detection & Hunting Pack

---
title: Suo5 Tunneling Endpoint Deployment in IIS Web Root
id: 9f2a1c44-7b3e-4d1a-a8c5-suo500000001
status: experimental
description: Detects creation of script files (.aspx, .ashx, .jsp, .php) in IIS web root or related directories consistent with Suo5 tunneling tool deployment via file upload exploitation.
author: Security Arsenal Threat Intelligence
references:
  - https://asec.ahnlab.com/en/95879/
  - https://otx.alienvault.com/
date: 2026/10/19
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\inetpub\wwwroot\aspnet_client\'
      - '\www\'
      - '\tomcat\webapps\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.jsp'
      - '.php'
  filter_legit:
    Image|contains:
      - '\Microsoft.NET\Framework\'
      - '\visual studio\'
  condition: selection_path and selection_ext and not filter_legit
falsepositives:
  - Legitimate web application deployments and CI/CD pipelines
  - Developer activity on production servers (should be rare)
level: high
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.t1105
---
title: Suspicious SOCKS5 Tunneling Network Activity from IIS Worker Process
id: 9f2a1c44-7b3e-4d1a-a8c5-suo500000002
status: experimental
description: Detects w3wp.exe (IIS worker process) initiating outbound internal network connections to lateral-movement ports (RDP, SMB, WinRM), consistent with Suo5 SOCKS5 pivoting through a compromised web server.
author: Security Arsenal Threat Intelligence
references:
  - https://asec.ahnlab.com/en/95879/
date: 2026/10/19
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\w3wp.exe'
      - '\tomcat9.exe'
      - '\httpd.exe'
      - '\nginx.exe'
  selection_ports:
    DestinationPort:
      - 3389
      - 445
      - 5985
      - 5986
      - 22
      - 1433
      - 3306
  selection_internal:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection_image and selection_ports and selection_internal
falsepositives:
  - Web applications legitimately connecting to internal databases (tune per-environment baselines)
  - Monitoring/scanner services running under IIS app pools
level: critical
tags:
  - attack.command_and_control
  - attack.t1090
  - attack.t1572
  - attack.lateral_movement
  - attack.t1021
---
title: Long-Lived HTTP Tunnel Session Indicators on Web Servers
id: 9f2a1c44-7b3e-4d1a-a8c5-suo500000003
status: experimental
description: Detects execution of suspicious process trees or command lines under web server worker processes that indicate post-exploitation tunnel setup, including Suo5 client/server execution and SOCKS5 proxy configuration.
author: Security Arsenal Threat Intelligence
references:
  - https://asec.ahnlab.com/en/95879/
date: 2026/10/19
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\tomcat9.exe'
      - '\java.exe'
  selection_cmd:
    CommandLine|contains:
      - 'suo5'
      - 'socks5'
      - '127.0.0.1:1111'
      - '-mode http'
      - 'proxy socks'
  condition: selection_parent and selection_cmd
falsepositives:
  - Rare; SOCKS5 tooling spawned from web worker processes is almost never legitimate
level: critical
tags:
  - attack.command_and_control
  - attack.t1090.001
  - attack.t1059

// Hunt: Suo5 tunneling artifacts — IIS worker processes spawning shells or making internal lateral connections
let lookback = 14d;
let suo5_hashes = dynamic([
  "810726bb14e100a122cd8fc189eb087f",
  "da6918a86f2165f44539c54b22d457660101228c",
  "5fa12b9a16d6d5bab38b4a6d8c4cd46afbcd8f54786131c618588073ebabd1a5"
]);
let HashHits = (
  DeviceFileEvents
  | where TimeGenerated > ago(lookback)
  | where MD5 in (suo5_hashes) or SHA1 in (suo5_hashes) or SHA256 in (suo5_hashes)
  | project HitType="IOC File Hash", TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName
);
let WebShellSpawn = (
  DeviceProcessEvents
  | where TimeGenerated > ago(lookback)
  | where InitiatingProcessFileName in~ ("w3wp.exe", "tomcat9.exe", "java.exe", "httpd.exe", "nginx.exe")
  | where FileName in~ ("cmd.exe", "powershell.exe", "net.exe", "net1.exe", "whoami.exe", "ipconfig.exe", "nltest.exe", "certutil.exe")
  | project HitType="Web Worker Shell Spawn", TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
);
let InternalPivot = (
  DeviceNetworkEvents
  | where TimeGenerated > ago(lookback)
  | where InitiatingProcessFileName in~ ("w3wp.exe", "tomcat9.exe", "java.exe", "nginx.exe")
  | where RemotePort in (3389, 445, 5985, 5986, 22, 1433, 3306)
  | where RemoteIP has_any ("10.", "172.16.", "192.168.")
  | summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RemoteIPs=make_set(RemoteIP), Ports=make_set(RemotePort) by DeviceName, InitiatingProcessFileName
  | project HitType="Web Server Internal Pivot", DeviceName, InitiatingProcessFileName, Connections, FirstSeen, LastSeen, RemoteIPs, Ports
);
union HashHits, WebShellSpawn, InternalPivot
| sort by TimeGenerated desc

# Suo5 Tunneling Hunt — run on suspected web servers or via remote sweep
# Checks: IOC hashes, suspicious web root scripts, anomalous w3wp connections, recent script drops

$iocHashes = @(
    "810726bb14e100a122cd8fc189eb087f",  # MD5
    "da6918a86f2165f44539c54b22d457660101228c",  # SHA1
    "5fa12b9a16d6d5bab38b4a6d8c4cd46afbcd8f54786131c618588073ebabd1a5"   # SHA256
)

$webRoots = @(
    "$env:SystemDrive\inetpub\wwwroot",
    "$env:SystemDrive\inetpub",
    "C:\xampp\htdocs",
    "C:\Program Files\Apache Software Foundation",
    "C:\nginx"
)

$findings = @()

Write-Host "[1/4] Scanning web roots for IOC hash matches and recently dropped scripts..." -ForegroundColor Cyan
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.aspx,*.ashx,*.asmx,*.jsp,*.php,*.dll,*.exe -ErrorAction SilentlyContinue |
            ForEach-Object {
                $md5  = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
                $sha1 = (Get-FileHash $_.FullName -Algorithm SHA1 -ErrorAction SilentlyContinue).Hash
                $sha256 = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                if ($iocHashes -contains ($md5, $sha1, $sha256 | Where-Object { $_ } | ForEach-Object { $_.ToLower() })) {
                    $findings += [PSCustomObject]@{ Type="IOC HASH MATCH"; Path=$_.FullName; SHA256=$sha256 }
                }
                # Flag scripts created or modified in last 30 days
                if ($_.LastWriteTime -gt (Get-Date).AddDays(-30)) {
                    $findings += [PSCustomObject]@{ Type="Recent web script"; Path=$_.FullName; SHA256=$sha256 }
                }
                # Content scan for Suo5/SOCKS5 markers in script files
                if ($_.Extension -match '\.(aspx|ashx|jsp|php)$') {
                    $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
                    if ($content -match 'suo5|socks5|Socks5|Socket.*proxy|chunked.*tunnel') {
                        $findings += [PSCustomObject]@{ Type="SUSPICIOUS CONTENT"; Path=$_.FullName; SHA256=$sha256 }
                    }
                }
            }
    }
}

Write-Host "[2/4] Checking for anomalous internal connections from web worker processes..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in 3389,445,5985,5986,22,1433,3306 -and
                   $_.RemoteAddress -match '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)' } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc.ProcessName -match 'w3wp|java|tomcat|nginx|httpd') {
            $findings += [PSCustomObject]@{ Type="WEB PROCESS PIVOT"; Path="$($proc.ProcessName) -> $($_.RemoteAddress):$($_.RemotePort)"; SHA256="n/a" }
        }
    }

Write-Host "[3/4] Enumerating IIS app pools and recent worker process anomalies..." -ForegroundColor Cyan
Get-Process w3wp -ErrorAction SilentlyContinue | ForEach-Object {
    $findings += [PSCustomObject]@{ Type="w3wp running (verify)"; Path="PID $($_.Id) — check loaded modules for unsigned DLLs"; SHA256="n/a" }
}

Write-Host "[4/4] Checking web logs for tunneling request patterns (IIS default path)..." -ForegroundColor Cyan
$logPath = "$env:SystemDrive\inetpub\logs\LogFiles"
if (Test-Path $logPath) {
    Get-ChildItem $logPath -Recurse -Filter *.log -ErrorAction SilentlyContinue |
        Sort-Object LastWriteTime -Descending | Select-Object -First 5 |
        ForEach-Object {
            Select-String -Path $_.FullName -Pattern 'application/octet-stream' -ErrorAction SilentlyContinue |
                Select-Object -First 20 |
                ForEach-Object { $findings += [PSCustomObject]@{ Type="OCTET-STREAM LOG HIT"; Path=$_.Path; SHA256=$_.LineNumber } }
        }
}

Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($findings.Count -eq 0) { Write-Host "No Suo5 indicators found." -ForegroundColor Green }
else { $findings | Format-Table -AutoSize | Out-String -Width 300 | Write-Host }
$findings | Export-Csv -Path ".\suo5_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation