16 minhigh
Defence Impairment Olympics
A threat actor compromised an IIS web server via Adobe ColdFusion vulnerabilities and deployed steganographic ASPX webshells concealed within image files. The attacker then executed a comprehensive defense impairment script that disabled IIS logging, tampered with Microsoft Defender through multiple vectors, killed and deleted security tool services, used IFEO debugger injection to neutralize monitoring binaries, and extracted credentials using a Mimikatz kernel driver after enabling WDigest plaintext caching. The attacker further uninstalled the ModSecurity WAF, deleted critical COM/CLSID registry keys to cripple OS functionality, and cleared all Windows event logs to destroy forensic evidence.
Sens:▲ 24hConf:high
Showing defanged values
- cveCVE-2023-26360Remote code execution vulnerability in Adobe ColdFusion exploited for initial access to the IIS web server.
- cveCVE-2023-29298Improper access control bug allowing external access to restricted CFIDE admin API endpoints.
- cveCVE-2023-29300Deserialization flaw in Adobe ColdFusion potentially used for code execution.
- filenameDisableDefender.ps1PowerShell script executed by i.bat to disable Microsoft Defender before being deleted from disk.
- filenamei.batDefense impairment batch script containing commands to disable logging, kill security tools, dump credentials, uninstall WAF, and delete registry keys. Dropped to C:\ProgramData\x\.
- filenamemimidrv.sysMimikatz kernel driver used for credential dumping from memory. Deleted by the attacker after use via the i.bat script.
- filenameUA4fp7R.aspxSteganographic ASPX webshell hidden inside an image file in the wwwroot\Images directory. Uses PNG header to evade detection and contains JScript payload with ONEPIECE marker.
- md5622d21c40a25f9834a03bfd5ff4710c1MD5 of cmd.exe process image observed spawning from w3wp.exe parent during webshell enumeration activity on June 7.
- sha198a9ac93fe31f38f47f38db78bf12fa0c6214f9aSHA1 of cmd.exe process image observed spawning from w3wp.exe parent during webshell enumeration activity on June 7.
- sha25640859ede262098086962ab00c89f02452aa9941c88c7f4ac002db166179980c6SHA256 hash of steganographic ASPX webshell 03Fl3i.aspx.
- sha256793768ce4fadab044c7502ea5ec4d8e1569283f289dfd73419e119f32d56d0f3SHA256 hash of PHP webshell jT1Ds.php.
- sha25694cd18f3f030fcc9b259dc410b17ea72a1f9800ee654f8e0f07a87bb9443b593SHA256 hash of i.bat, the defense impairment and credential dumping batch script dropped to C:\ProgramData\x\.
- sha256bd74a00f4d2ec3bf50d13ddf324bb368b2464d547abd0c572ef5e2f77943a920SHA256 hash of steganographic ASPX webshell UA4fp7R.aspx dropped into wwwroot\Images directory. Contains embedded ONEPIECE marker string.
- sha256f0ff36ecdc843351913dbfbd9122b62563894936ff64215a7a2f89181ebdb57fSHA256 hash of webshell RG0eQV6.php.
- sha256f63d293e117cae1d0a6c24359fc1361a9dc48178049cc6491051b09268c8c39cSHA256 hash of steganographic webshells WRBYTR5750images.aspx and MRBTPS5754images.aspx. Same hash indicates identical file content.
Detection / Hunteropenrouter
What Happened
Attackers broke into a web server by exploiting known security flaws in Adobe ColdFusion software. They hid malicious web shells inside image files to avoid detection. After gaining access, they ran a script that systematically disabled security tools, turned off logging, and weakened password protections on the server. They then stole passwords and login credentials from the server's memory and deleted records of their activity to cover their tracks. The attackers also removed a web application firewall and damaged core Windows system files to make recovery harder. Organizations running Adobe ColdFusion should apply all available security patches immediately, ensure web servers have proper logging enabled, and verify that incident response remediation is completed fully before bringing compromised servers back online.
Key Takeaways
- Threat actor exploited Adobe ColdFusion vulnerabilities (CVE-2023-26360, CVE-2023-29298, CVE-2023-29300) to deploy steganographic ASPX webshells hidden inside image files on an IIS web server.
- Attacker executed a comprehensive defense impairment batch script (i.bat) that disabled IIS logging, tampered with Microsoft Defender via multiple methods, killed security tool processes (Sysmon, Filebeat, Cortex, Sentinel), and used IFEO debugger injection to neutralize security binaries.
- Credential dumping was performed using a Mimikatz kernel driver (mimidrv.sys) after enabling WDigest plaintext credential caching via registry modification and extracting plaintext ODBC credentials from the registry.
- Attacker uninstalled the ModSecurity IIS WAF module, deleted critical COM/CLSID registry keys to cripple OS functionality, and cleared all major Windows event logs to hinder forensics.
- The webshells contained embedded marker strings 'ONEPIECE' and 'x_best_911' used as operational status indicators, appearing across all webshells found during the investigation.
Affected Systems
- Adobe ColdFusion (vulnerable to CVE-2023-26360, CVE-2023-29298, CVE-2023-29300)
- Microsoft IIS Web Server
- Windows Server (running Sysmon, Filebeat, Cortex, Sentinel, or DrWebCom security tools)
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2023-26360 | Adobe ColdFusion | Critical | Remote code execution vulnerability in Adobe ColdFusion exploited for initial access to the IIS web server. |
| CVE-2023-29298 | Adobe ColdFusion | High | Improper access control bug allowing external access to restricted CFIDE admin API endpoints. |
| CVE-2023-29300 | Adobe ColdFusion | High | Deserialization flaw in Adobe ColdFusion potentially used for code execution. |
Attack Chain
- Initial Access: Adobe ColdFusion exploitation (CVE-2023-26360, CVE-2023-29298, CVE-2023-29300) on IIS web server via targeted CFIDE admin API endpoints
- Persistence: Steganographic ASPX webshells uploaded to wwwroot\Images directory, concealed inside image files with PNG headers
- Discovery: Enumeration via whoami, net/net1 user commands, and registry queries for installed software including FileZilla
- Defense Evasion: Timestomping of webshell MAC times, disabling IIS logging, tampering with Defender via PowerShell and registry, killing security tool processes, IFEO debugger injection for Sysmon/SetACL/Filebeat, uninstalling ModSecurity WAF
- Credential Access: WDigest UseLogonCredential registry modification, ODBC credential extraction from registry, Mimikatz kernel driver (mimidrv.sys) credential dumping to pass.txt and hash.txt
- Impact: Deletion of critical COM/CLSID registry keys to cripple OS functionality, clearing all Windows event logs (security, system, application, Setup)
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No formal detection rules (YARA, Sigma, Snort/Suricata, KQL, SPL, EQL) are provided in the article. Detection guidance is limited to behavioral descriptions and IOC listings.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The attacker systematically killed or disabled EDR-adjacent tools (Sysmon, Filebeat, Cortex cyserver, Sentinel) and used IFEO debugger injection to prevent them from restarting. If the EDR itself was not targeted, process creation events showing w3wp.exe spawning cmd.exe with whoami/net commands would be visible. However, once defense impairment commands execute, subsequent visibility may be lost. |
| Network Visibility | Low | The attacker disabled IIS HTTP logging via appcmd, which would eliminate web request logs. Network-level visibility (if independent of the host) could still capture C2 or exfiltration traffic, but the article does not describe network-based detection. The ColdFusion exploitation endpoints would be visible in IIS logs only if logging was not yet disabled. |
| Detection Difficulty | Hard | The attacker employed multiple defense impairment techniques that specifically target security tooling and logging infrastructure. IFEO debugger injection, service deletion, process killing, and event log clearing all reduce telemetry available to defenders. Detection requires catching the initial webshell deployment and enumeration before defense impairment occurs, or having out-of-band logging that the attacker cannot disable. |
Required Log Sources
- Windows Security Event Log (Event ID 4688 - Process Creation)
- Windows System Event Log
- Windows Application Event Log
- Sysmon Event Log (Event ID 1 - ProcessCreate, Event ID 11 - FileCreate, Event ID 12-14 - Registry events)
- IIS W3SVC Logs
- PowerShell Script Block Logging (Event ID 4104)
- Windows Registry Auditing (for WDigest, IFEO, Defender policy keys)
- EDR telemetry (if not disabled by attacker)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for w3wp.exe spawning cmd.exe or powershell.exe with OS reconnaissance commands, which indicates webshell execution on IIS servers. | Process creation events (Sysmon EID 1 or Windows EID 4688) showing parent-child relationship between w3wp.exe and command interpreters. | Initial Access / Execution | Low. Legitimate web applications rarely spawn OS command interpreters. Some administrative tools or web-based management consoles may trigger this behavior. |
| Consider hunting for Set-MpPreference cmdlets being invoked to disable Defender features, especially when executed from batch files or scripts in non-standard paths. | PowerShell Script Block Logging (EID 4104) and process creation events showing powershell.exe with Set-MpPreference arguments. | Defense Evasion | Low to Medium. Legitimate endpoint management tools may use Set-MpPreference for configuration, but disabling real-time monitoring and behavior monitoring is uncommon in normal operations. |
| Consider hunting for registry modifications to IFEO keys setting Debugger values for security tool executables, which indicates an attempt to neutralize monitoring tools. | Sysmon Registry events (EID 12-14) or Windows Registry Auditing for HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options*\Debugger. | Defense Evasion | Low. IFEO debugger entries for security tools are highly suspicious and rarely legitimate. |
| Consider hunting for WDigest UseLogonCredential registry value being set to 1, which enables plaintext credential caching and is a precursor to credential dumping. | Sysmon Registry events (EID 12-14) or Windows Registry Auditing for HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential. | Credential Access | Low. This registry value is set to 0 by default on modern Windows. Setting it to 1 is a well-known credential dumping precursor. |
| Consider hunting for wevtutil cl commands being executed outside of authorized maintenance windows, which indicates event log clearing to destroy forensic evidence. | Process creation events (Sysmon EID 1 or Windows EID 4688) showing wevtutil.exe with 'cl' arguments. Windows EID 1102 (audit log cleared) should also be monitored. | Defense Evasion | Medium. System administrators may clear logs during legitimate maintenance, but clearing multiple logs in sequence from a script is suspicious. |
Control Gaps
- Host-based security tools (Sysmon, Filebeat, Cortex, Sentinel) can be killed, stopped, and deleted by an attacker with administrative privileges, eliminating telemetry.
- IFEO debugger injection can prevent security tool executables from launching even if services attempt to restart them.
- IIS logging can be disabled via appcmd, removing web request audit trails.
- Windows event logs can be cleared via wevtutil, destroying forensic evidence.
- Microsoft Defender can be disabled through multiple vectors (PowerShell cmdlets, registry policy keys, WMIC exclusions) that may not all be monitored.
- ModSecurity WAF can be uninstalled via appcmd, removing web-layer protection without requiring a reboot.
- If no out-of-band or centralized logging exists, an attacker who disables all host logging gains full visibility gap.
Key Behavioral Indicators
- w3wp.exe spawning cmd.exe or powershell.exe as child processes
- ASPX files created in image directories (e.g., wwwroot\Images)
- PNG image files containing embedded JScript or ASP.NET directives
- Batch files executing multiple Set-MpPreference commands in sequence
- WMIC calls to MSFT_MpPreference class for adding exclusions
- taskkill.exe targeting multiple security tool processes in rapid succession
- sc.exe stop and delete commands targeting security services
- Registry modifications to IFEO Debugger values for security executables
- WDigest UseLogonCredential registry value set to 1
- wevtutil cl commands clearing multiple event logs
- appcmd uninstall module commands removing ModSecurity
- net1.exe used instead of net.exe for localgroup enumeration (potential detection bypass)
- Files with .mdk extension in C:\ProgramData\x\
- Registry deletion of HKEY_CLASSES_ROOT CLSID keys for WScript and Shell.Application
False Positive Assessment
Low. The combination of webshell deployment from w3wp.exe, defense impairment commands, IFEO debugger injection, WDigest modification, and event log clearing forms a high-confidence attack pattern. Individual indicators such as Set-MpPreference or wevtutil commands may have legitimate administrative uses, but the sequential execution of multiple defense impairment techniques in a single batch script is highly indicative of malicious activity.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider patching all Adobe ColdFusion instances against CVE-2023-26360, CVE-2023-29298, and CVE-2023-29300 immediately if these vulnerabilities are present in your environment.
- If you identify any of the listed webshell hashes on your endpoints, consider isolating the affected host and initiating incident response procedures.
- Consider searching for the marker strings 'ONEPIECE' and 'x_best_911' in ASPX and PHP files across web directories to identify potential steganographic webshells.
- If applicable, verify that any compromised servers are fully remediated before returning them to production. The article describes the attacker returning twice because the server was brought back online prematurely.
- Consider checking for the presence of C:\ProgramData\x\i.bat or files with .mdk extension in C:\ProgramData\x\ as indicators of compromise.
Infrastructure Hardening
- Consider implementing centralized, out-of-band logging that cannot be disabled from the endpoint (e.g., forwarding Sysmon and Windows Event Logs to a SIEM via a mechanism the local administrator cannot stop).
- Evaluate whether your IIS servers have HTTP logging enabled and consider monitoring for appcmd commands that disable logging.
- If supported by your tooling, consider deploying a WAF solution that cannot be uninstalled from the host itself, or monitor for appcmd uninstall module commands.
- Consider implementing tamper protection for Microsoft Defender via Microsoft Defender for Endpoint or equivalent EDR with anti-tamper capabilities.
- Evaluate whether ColdFusion admin API endpoints (/CFIDE/adminapi/*) are restricted from external access and consider implementing URL rewrite rules or IP restrictions to block unauthorized access.
- Consider placing internal web servers behind a firewall or VPN if there is no business requirement for internet-facing access.
User Protection
- Consider deploying EDR with anti-tamper protection that resists process killing, service deletion, and IFEO debugger injection.
- If your organization uses Sysmon, consider implementing a configuration that monitors for registry modifications to IFEO keys, WDigest settings, and Defender policy keys.
- Evaluate whether your security tools have crash recovery and tamper-resistant service configurations that prevent unauthorized stopping or deletion.
- Consider monitoring for timestomped files with implausible timestamps (e.g., creation dates in the year 2185 as observed in this incident).
Security Awareness
- Consider incorporating guidance on the importance of complete incident response remediation into existing awareness programs, emphasizing that partially remediated systems remain vulnerable to attacker return.
- If applicable, consider training web server administrators to recognize unusual ASPX or PHP files in image directories and to report them to security teams.
- Consider educating system administrators on the risk of defense impairment techniques and the importance of monitoring for unauthorized changes to security tool configurations.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping12 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Credential Access
Tactic
Impact
Additional IOCs
- Urls:
/CFIDE/adminapi/_datasource/setmsaccessRegistry.cfm- ColdFusion endpoint targeted during exploitation attempt, indicating CVE-2023-29298 access control bypass./CFIDE/adminapi/_datasource/setsldatasource.cfm- ColdFusion endpoint targeted during exploitation attempt./CFIDE/adminapi/_datasource/setdsn.cfm- ColdFusion endpoint targeted during exploitation attempt./CFIDE/adminapi/_datasource/formatjdbcurl.cfm- ColdFusion endpoint targeted during exploitation attempt./CFIDE/adminapi/_datasource/getaccessdefaultsfromRegistry.cfm- ColdFusion endpoint targeted during exploitation attempt./CFIDE/adminapi/_datasource/geturldefaults.cfm- ColdFusion endpoint targeted during exploitation attempt./CFIDE/adminapi/customtags/l10n.cfm- ColdFusion endpoint targeted during exploitation attempt./CFIDE/adminapi/serverinstance.cfc- ColdFusion endpoint targeted during exploitation attempt./CFIDE/adminapi/servermonitoring.cfc- ColdFusion endpoint targeted during exploitation attempt.
- File Hashes:
48985b22a895154cc44f9eb77489cfdf54fa54506e8caef492fe30f40d27e90(SHA256) - SHA256 of cmd.exe process image observed spawning from w3wp.exe parent during webshell enumeration activity on June 7.622d21c40a25f9834a03bfd5ff4710c1(MD5) - MD5 of cmd.exe process image observed spawning from w3wp.exe parent during webshell enumeration activity on June 7.98a9ac93fe31f38f47f38db78bf12fa0c6214f9a(SHA1) - SHA1 of cmd.exe process image observed spawning from w3wp.exe parent during webshell enumeration activity on June 7.
- Registry Keys:
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest- UseLogonCredential value set to 1 to force plaintext credential caching in memory, enabling subsequent credential dumping.HKLM\SOFTWARE\Policies\Microsoft\Windows Defender- DisableAntiSpyware value set to 1 to disable Windows Defender via Group Policy registry keys.HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection- Multiple values (DisableRealtimeMonitoring, DisableBehaviorMonitoring, DisableOnAccessProtection) set to 1 to disable Defender real-time protection features.HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysmon.exe- Debugger value set to 'ntsd -d' to prevent Sysmon from executing via IFEO injection.HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysmon64.exe- Debugger value set to 'ntsd -d' to prevent Sysmon64 from executing via IFEO injection.HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SetACL.exe- Debugger value set to 'ntsd -d' to prevent SetACL from executing, allowing attacker to access sensitive files.HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\filebeat.exe- Debugger value set to 'ntsd -d' to prevent Filebeat from executing via IFEO injection.HKEY_CLASSES_ROOT\Wscript.shell- Deleted by attacker to cripple OS scripting capabilities and prevent remediation scripts from running.HKEY_CLASSES_ROOT\Shell.Application- Deleted by attacker to break File Explorer, folder navigation, and regular system functions.HKEY_CLASSES_ROOT\CLSID\{093FF999-1EA0-4079-9525-9614C3504B74}- Deleted by attacker to break WScript.Network functionality and prevent scripts from mapping network drives.HKEY_CLASSES_ROOT\CLSID\{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}- Deleted by attacker to block WScript Shell invocation by CLSID, preventing bypass of text-name-based deletion.HKEY_CLASSES_ROOT\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}- Deleted by attacker to block Windows Script Host from spawning script host instances.HKEY_CLASSES_ROOT\CLSID\{13709620-C279-11CE-A49E-444553540000}- Deleted by attacker to disable the underlying Shell.Application engine, further hampering script execution.
- File Paths:
C:\ProgramData\x\- Directory added as a Microsoft Defender exclusion path. Used by attacker to store tools and scripts including i.bat.C:\ProgramData\x\i.bat- Location of the defense impairment batch script on disk.wwwroot\Images\- IIS web directory where steganographic ASPX webshells were uploaded. Unusual location for executable ASPX files.
- Command Lines:
- Purpose: Disable IIS HTTP logging to prevent detection of subsequent webshell POST requests | Tools:
appcmd.exe| Stage: Defense Evasion |%windir%\system32\inetsrv\appcmd set config /section:httpLogging /dontLog:True - Purpose: Disable Microsoft Defender real-time monitoring, behavior monitoring, IOAV protection, script scanning, and sample submission | Tools:
powershell.exe| Stage: Defense Evasion |powershell -c "Set-MpPreference -DisableRealtimeMonitoring $True" - Purpose: Add Defender exclusion paths and extensions to prevent scanning of attacker tools | Tools:
wmic.exe| Stage: Defense Evasion - Purpose: Kill security tool processes including Sysmon, Filebeat, Cortex, Sentinel, and DrWebCom | Tools:
taskkill.exe| Stage: Defense Evasion |taskkill /im <processname> /f - Purpose: Stop and delete security tool services to prevent automatic restart | Tools:
sc.exe| Stage: Defense Evasion |sc stop <servicename> && sc delete <servicename> - Purpose: Import WDigest registry file to enable plaintext credential caching | Tools:
regedit.exe| Stage: Credential Access |regedit /s <filename> - Purpose: Enable WDigest UseLogonCredential to force plaintext passwords in memory | Tools:
reg.exe| Stage: Credential Access - Purpose: Extract plaintext ODBC credentials stored in registry | Tools:
regedit.exe| Stage: Credential Access |REGEDIT /e <outputfile> HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\ODBC.INI - Purpose: Set IFEO debugger values to neutralize security tool executables | Tools:
reg.exe| Stage: Defense Evasion - Purpose: Enumerate local administrator groups across multiple languages to identify privileged accounts | Tools:
net1.exe| Stage: Discovery |net1 localgroup <groupname> - Purpose: Clear Windows event logs to destroy forensic evidence | Tools:
wevtutil.exe| Stage: Defense Evasion |wevtutil cl <logname> - Purpose: Uninstall ModSecurity WAF module from IIS to remove web-layer protection | Tools:
appcmd.exe| Stage: Defense Evasion |%windir%\system32\inetsrv\appcmd uninstall module <modulename>
- Purpose: Disable IIS HTTP logging to prevent detection of subsequent webshell POST requests | Tools:
- Other:
ONEPIECE- Hex-encoded marker string (x4F x4E x45 x50 x49 x45 x43 x45) embedded in all webshells. Sent as response to indicate the shell is operational.x_best_911- Marker string embedded in webshell payload. Sent as response when the shell executes a command, indicating successful execution..mdk- File extension added as a Microsoft Defender exclusion. Likely used for attacker tools or output files.
Related
Stay currentSubscribe via RSS
