Webshell Intrusion on Municipal Platforms + TA419 AiTM Credential Phishing: OTX Pulse Analysis — Detection & Hunt Pack

---
title: Webshell Dropped into Web Application Upload Directory
id: 9f2c1a7e-3b44-4d8a-9c1f-muniwebshell01
status: experimental
description: Detects web server worker processes writing script/executable files into upload or web-accessible directories, consistent with the parks & rec platform webshell deployment via abused member file-upload functionality.
author: Security Arsenal Threat Intelligence
references:
  - https://www.huntress.com/blog/parks-recreation-platform-webshell-attack
date: 2026/10/02
logsource:
  category: file_event
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\tomcat9.exe'
      - '\java.exe'
  selection_target:
    TargetFilename|contains:
      - '\uploads\'
      - '\upload\'
      - '\members\'
      - '\files\'
      - '\inetpub\wwwroot\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.asp'
      - '.php'
      - '.jsp'
      - '.ashx'
      - '.cshtml'
  condition: selection_parent and selection_target and selection_ext
falsepositives:
  - Legitimate CMS/plugin updates writing templates into content directories
level: high
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.t1105
---
title: Timestomping of File in Web Server Directory
id: 7a3d5b2c-8e11-4f6a-b2d9-timestomp002
status: experimental
description: Detects timestamp manipulation tooling or API abuse altering file creation/modification times inside web-accessible directories, matching the timestomping behavior used to hide webshells among legitimate recreation platform files.
author: Security Arsenal Threat Intelligence
references:
  - https://www.huntress.com/blog/parks-recreation-platform-webshell-attack
date: 2026/10/02
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\timestomp.exe'
      - '\setmace.exe'
      - '\nircmd.exe'
  selection_cmdline:
    CommandLine|contains:
      - 'SetFileTime'
      - '-CreationTimeUtc'
      - 'LastWriteTime'
  selection_path:
    CommandLine|contains:
      - 'inetpub'
      - 'wwwroot'
      - 'uploads'
  condition: 1 of selection_tools or (selection_cmdline and selection_path)
falsepositives:
  - Rare; backup/restore utilities may legitimately restore timestamps
level: high
tags:
  - attack.defense_evasion
  - attack.t1070.006
---
title: TA419 AiTM Phishing Infrastructure DNS Resolution
id: 4c8e1f9a-62d3-4b7c-a1e5-ta419aitm003
status: experimental
description: Detects DNS resolution or outbound connection to TA419 frameless BitB / AiTM credential phishing domains impersonating file-sharing services, targeting AI policy staff at think tanks and universities.
author: Security Arsenal Threat Intelligence
references:
  - https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy
date: 2026/10/02
logsource:
  category: dns
detection:
  selection_iocs:
    query|contains:
      - 'sharehub.space'
      - 'driftshare.co'
      - 'globalfileshareplatform.com'
      - 'quickfly.online'
      - 'smartsyncbox.com'
      - 'cirrushare.co'
      - 'mypublicshare.com'
      - 'goshshare.online'
  condition: selection_iocs
falsepositives:
  - Threat research or sandbox detonation of the lure
level: critical
tags:
  - attack.credential_access
  - attack.t1566.002
  - attack.t1557

// Hunt: TA419 AiTM phishing connections + webshell process lineage
// Microsoft Sentinel / MDE — run over last 30 days
let ta419_domains = dynamic(["sharehub.space","driftshare.co","globalfileshareplatform.com","quickfly.online","smartsyncbox.com","cirrushare.co","mypublicshare.com","goshshare.online"]);
let network_hits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (ta419_domains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType
| extend HuntType = "TA419_AiTM_Domain";
let webshell_lineage = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("w3wp.exe","httpd.exe","tomcat9.exe","nginx.exe")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","whoami.exe","net.exe","nltest.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| extend HuntType = "Webshell_Child_Process";
let webshell_hash_hits = DeviceFileEvents
| where TimeGenerated > ago(30d)
| where SHA256 in ("0d8f7bf30aa1ac95d59fed24c433dd2b3d57767f38c088721699c841c6e861d3","0d93c3a8ded46887f79ac4ca7f238c458de2231243176f6c05062e34f238d19a","5f69ff7a2e024f94cc5f816fa16c90054b09d9ac430b1f8b0631dfdd4472905e","7bb594a77f726bf21a49f717024f2915f82f47eb623d2ad305259301de1f1ab4","b06b581d91f4108900d188c3ee1af18502a8cb65d4e101663b791bd670867485","e9dee286069afb6b411febb96b91a963cd16baffbf8b6aa951e0ef1a7e0e3879")
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, ActionType
| extend HuntType = "Webshell_Hash_Match";
union network_hits, webshell_lineage, webshell_hash_hits
| sort by TimeGenerated desc

# Security Arsenal — Webshell & TA419 AiTM IOC Hunt Script
# Run elevated on suspected web servers and user endpoints.

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# --- 1. Webshell hash sweep of common webroots ---
$webshellHashes = @(
  "0d8f7bf30aa1ac95d59fed24c433dd2b3d57767f38c088721699c841c6e861d3",
  "0d93c3a8ded46887f79ac4ca7f238c458de2231243176f6c05062e34f238d19a",
  "5f69ff7a2e024f94cc5f816fa16c90054b09d9ac430b1f8b0631dfdd4472905e",
  "7bb594a77f726bf21a49f717024f2915f82f47eb623d2ad305259301de1f1ab4",
  "b06b581d91f4108900d188c3ee1af18502a8cb65d4e101663b791bd670867485",
  "e9dee286069afb6b411febb96b91a963cd16baffbf8b6aa951e0ef1a7e0e3879"
)
$webRoots = @("C:\inetpub\wwwroot","C:\inetpub","D:\www","C:\xampp\htdocs") | Where-Object { Test-Path $_ }
foreach ($root in $webRoots) {
  Get-ChildItem -Path $root -Recurse -Include *.aspx,*.asp,*.php,*.ashx,*.jsp,*.cshtml -File | ForEach-Object {
    $h = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash.ToLower()
    if ($webshellHashes -contains $h) {
      $report += [PSCustomObject]@{Type="WEBSHELL_HASH_HIT"; Path=$_.FullName; Hash=$h}
    }
  }
}

# --- 2. Timestomping heuristic: script files with creation time older than neighbours ---
foreach ($root in $webRoots) {
  Get-ChildItem -Path $root -Recurse -Directory | ForEach-Object {
    $dir = $_.FullName
    $files = Get-ChildItem -Path $dir -File
    $scripts = $files | Where-Object { $_.Extension -in '.aspx','.asp','.php','.ashx','.jsp' }
    if ($files.Count -gt 3 -and $scripts) {
      $medianWrite = ($files | Sort-Object LastWriteTime)[[int]($files.Count/2)].LastWriteTime
      foreach ($s in $scripts) {
        if ([math]::Abs(($s.CreationTime - $medianWrite).TotalDays) -gt 30) {
          $report += [PSCustomObject]@{Type="TIMESTOMP_SUSPECT"; Path=$s.FullName; Hash="Created=$($s.CreationTime) Modified=$($s.LastWriteTime)"}
        }
      }
    }
  }
}

# --- 3. TA419 AiTM domain connections (DNS cache + netstat) ---
$ta419 = @("sharehub.space","driftshare.co","globalfileshareplatform.com","quickfly.online","smartsyncbox.com","cirrushare.co","mypublicshare.com","goshshare.online")
$dnsCache = Get-DnsClientCache | Where-Object { $d = $_.Entry; $ta419 | Where-Object { $d -like "*$_*" } }
foreach ($e in $dnsCache) { $report += [PSCustomObject]@{Type="TA419_DNS_CACHE"; Path=$e.Entry; Hash=$e.Data} }
Get-NetTCPConnection -State Established | ForEach-Object {
  $proc = Get-Process -Id $_.OwningProcess
  try { $r = (Resolve-DnsName $_.RemoteAddress -ErrorAction Stop).NameHost } catch { $r = "" }
  if ($ta419 | Where-Object { $r -like "*$_*" }) {
    $report += [PSCustomObject]@{Type="TA419_ACTIVE_CONN"; Path="$($proc.ProcessName) -> $($_.RemoteAddress):$($_.RemotePort)"; Hash=$r}
  }
}

if ($report) { $report | Format-Table -AutoSize; $report | Export-Csv ".\otx_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation }
else { Write-Host "[+] No OTX IOC hits found on $env:COMPUTERNAME" -ForegroundColor Green }