12 minhigh
Home Field Advantage: How Attackers Reshape Victim Environments
A threat actor exploited an SQL injection vulnerability in an IIS web application to gain initial access to a Windows endpoint running MSSQL. After access, the attacker performed extensive environment modifications including reconnaissance via tasklist, exfiltration to an OAST domain, creation of a new local administrator account, enabling Terminal Services, disabling Windows Defender, installing BadIIS modules, deploying an XMRig cryptocurrency miner with persistence, and adding CnCrypt Protect for defense evasion. The breadth of modifications on a single endpoint was notable compared to similar incidents.
Sens:▲ 24hConf:
Showing defanged values
- domain334thribetlhkyo977gqrcht1k7bvdj2[.]oastify[.]comOAST exfiltration endpoint used to receive output of tasklist /svc via HTTP POST for reconnaissance
- domainpub-c4c8e8c336c336c3429d97195076bf3bb6eb[.]r2[.]devCloudflare R2 storage bucket observed in image artifact hosting XMRig miner download; may be variant or typo of the text-sourced domain
- domainpub-c4c8e8c336c3429d97195076bf3bb6eb[.]r2[.]devCloudflare R2 storage bucket used to host malicious PowerShell scripts and payloads for download
- filenameCnCryptProtect1.32.exeDefense evasion tool executed from adminweb2$ user desktop, likely to assist in avoiding detection
- filenameedge.exeDisguised cryptocurrency miner executable placed in C:\Program Files (x86)\Microsoft\EdgeUpdate\ with hidden/system attributes set via attrib.exe
- filenameHttpCgiModule.dllBadIIS malicious module installed via appcmd.exe on 32-bit IIS for SEO fraud and traffic manipulation
- filenameHttpFastCgiModule.dllBadIIS malicious module installed via appcmd.exe on 64-bit IIS for SEO fraud and traffic manipulation
- filenameqdcjoke1.2.ps1Initial PowerShell script downloaded to C:\users\public\ by SQL server-spawned cmd.exe; downloads additional payloads including c_joke1.2.ps1
- filenamexmr-1.zipArchive containing XMRig cryptocurrency miner downloaded to C:\Program Files (x86)\Microsoft\EdgeUpdate\
- urlhxxp://334thribetlhkyo977gqrcht1k7bvdj2[.]oastify[.]comFull exfiltration URL receiving tasklist /svc output via Invoke-WebRequest POST
- urlhxxps://pub-c4c8e8c336c336c3429d97195076bf3bb6eb[.]r2[.]dev/wk/009/xmr-1[.]zipDirect download URL for XMRig cryptocurrency miner archive (xmr-1.zip) retrieved via PowerShell WebClient
Detection / Hunteropenrouter
What Happened
Attackers broke into a company's computer system through a weakness in a website that did not properly check user input (a type of attack called SQL injection). Once inside, instead of immediately stealing data or locking files, they spent time reshaping the system to their advantage. They created a hidden administrator account, turned on remote desktop access, disabled antivirus, installed malicious web server components, and set up a cryptocurrency miner to generate money at the victim's expense. They also downloaded multiple scripts and tools to hide their activities. Organizations with web applications and database servers should ensure all user input is properly validated, keep software updated, monitor for unusual account creation or system changes, and use multi-factor authentication. If an incident is found, it is important to identify how the attackers got in originally so they cannot return.
Key Takeaways
- Threat actor gained initial access via SQL injection in an IIS-hosted web application with improper input validation, then made unusually broad modifications to the compromised environment
- Attacker created a new local administrator account (adminweb2$), enabled Terminal Services, and used it for persistent remote access
- BadIIS modules (HttpFastCgiModule.dll and HttpCgiModule.dll) were installed via appcmd.exe for SEO fraud capabilities
- XMRig cryptocurrency miner was deployed with persistence via nssm.exe, hidden using attrib.exe, and supplemented with CnCrypt Protect for defense evasion
- Multiple PowerShell scripts and batch files were downloaded from a Cloudflare R2 storage bucket, using hidden window styles and execution policy bypass
Affected Systems
- Microsoft SQL Server (MSSQL)
- Microsoft Internet Information Services (IIS)
- Windows endpoints with Terminal Services/RDP
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: SQL injection vulnerability in IIS web application with improper input validation allows threat actor to access MSSQL endpoint
- Execution: Base64-encoded PowerShell downloads scripts (qdcjoke1.2.ps1) from Cloudflare R2 storage to C:\users\public\
- Reconnaissance: tasklist /svc enumerates running processes; output exfiltrated to OAST domain via HTTP POST
- Persistence: Terminal Services enabled; adminweb2$ account created and added to local Administrators group; BadIIS modules installed via appcmd.exe; nssm.exe creates service for XMRig miner
- Defense Evasion: Windows Defender disabled; attrib.exe sets hidden/system attributes on miner files; CnCrypt Protect 1.32.exe added
- Impact: XMRig cryptocurrency miner deployed from xmr-1.zip, executing as edge.exe with service persistence via nssm.exe
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules (YARA, Sigma, Snort/Suricata, KQL, SPL, EQL) are provided in the article. The article is an incident analysis blog post describing TTPs and IOCs but does not include reusable detection logic.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The threat actor disabled Windows Defender but did not target other EDR solutions, meaning EDR telemetry should still capture process creation, account creation, service creation, and file attribute modifications. However, the use of legitimate tools (appcmd.exe, nssm.exe, attrib.exe) may blend with normal administrative activity. |
| Network Visibility | Medium | HTTP POST to the OAST domain and HTTPS downloads from Cloudflare R2 storage are network-detectable. However, traffic to Cloudflare R2 may appear legitimate, and the OAST domain pattern requires DNS logging or threat intelligence correlation to identify. |
| Detection Difficulty | Moderate | Individual actions (account creation, service creation, file downloads) are detectable with standard logging, but the threat actor uses legitimate Windows tools (appcmd.exe, nssm.exe, attrib.exe, tasklist.exe) that may generate false positives. The key challenge is correlating the breadth of modifications on a single endpoint and identifying the SQL injection as the root cause. |
Required Log Sources
- Windows Security Event Log (Event ID 4720 - account creation, 4732 - member added to group, 4688 - process creation)
- PowerShell Script Block Logging (Event ID 4104)
- Windows System Event Log (service creation, Terminal Services enablement)
- IIS W3SVC logs (for SQL injection detection)
- Sysmon Event ID 1 (process creation), 3 (network connection), 11 (file creation), 13 (registry value set)
- DNS resolution logs
- EDR process telemetry with command-line arguments
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for SQL server process (sqlservr.exe) spawning command shells or PowerShell, which would indicate potential SQL injection leading to command execution. This is a high-fidelity indicator of compromise via database exploitation. | Process creation logs (Sysmon EID 1, Windows Security EID 4688, EDR process telemetry) showing parent-child process relationships | Initial Access / Execution | Low - SQL server spawning cmd.exe or powershell.exe is rarely legitimate in production environments |
| Consider hunting for newly created local user accounts that are subsequently added to the local Administrators group within a short time window, which may indicate attacker persistence via account creation. | Windows Security Event Log EID 4720 (account created) and EID 4732 (member added to local group) correlated by account name and time | Persistence | Medium - legitimate administrative account creation can trigger this; consider filtering known IT management accounts and change management windows |
| Consider hunting for appcmd.exe being used to install IIS modules, particularly with module names containing HttpCgi or HttpFastCgi, which may indicate BadIIS module installation for SEO fraud. | Process creation logs with command-line arguments showing appcmd.exe with 'install module' parameters | Persistence | Low to Medium - appcmd.exe module installation is uncommon in steady-state operations but may occur during legitimate IIS configuration changes |
| Consider hunting for nssm.exe being used to create Windows services, especially when the service executable path points to non-standard directories or files with system/hidden attributes, which may indicate cryptocurrency miner persistence. | Process creation logs for nssm.exe, Windows System Event Log for service creation (EID 7045), Sysmon EID 1 for nssm.exe execution | Persistence | Medium - nssm.exe is a legitimate tool used by some administrators; correlate with service executable path and file reputation |
| Consider hunting for attrib.exe setting both hidden and system attributes on files, particularly in non-standard directories like EdgeUpdate or ProgramData, which may indicate defense evasion for malware files. | Process creation logs with command-line arguments for attrib.exe containing +s and +h flags | Defense Evasion | Medium - some legitimate software sets hidden attributes; focus on files in unusual paths or with suspicious names |
Control Gaps
- Web Application Firewall (WAF) rules did not prevent SQL injection through the IIS-hosted web application
- Input validation on the vulnerable web page was insufficient to prevent SQL injection
- Windows Defender was disabled without triggering alerts for security tool impairment
- Terminal Services enablement on the endpoint did not trigger configuration change alerts
- BadIIS module installation via appcmd.exe was not blocked by application control or IIS configuration monitoring
Key Behavioral Indicators
- sqlservr.exe spawning cmd.exe or powershell.exe as child processes
- New local user account creation (e.g., adminweb2$) followed by addition to Administrators group
- appcmd.exe with 'install module' arguments referencing HttpCgiModule or HttpFastCgiModule
- nssm.exe creating services pointing to executables in non-standard paths
- attrib.exe setting +s +h attributes on files in EdgeUpdate or ProgramData directories
- PowerShell execution with -ExecutionPolicy Bypass -WindowStyle Hidden flags
- System.Net.WebClient.DownloadFile calls to r2.dev domains
- HTTP POST requests to oastify.com domains carrying process listing data
- Terminal Services being enabled on endpoints where it was previously disabled
- Windows Defender service being stopped or disabled
False Positive Assessment
Medium - The threat actor extensively uses legitimate Windows administrative tools (tasklist.exe, appcmd.exe, attrib.exe, nssm.exe, PowerShell) which may generate false positives in environments with active system administration. However, the correlation of multiple modifications on a single endpoint, combined with specific indicators like the adminweb2$ account name, BadIIS module names, and OAST domain exfiltration, significantly reduces false positive risk when detection rules require multiple signals.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching endpoint and network telemetry for the identified IOCs including oastify.com domains, r2.dev payload hosting URLs, BadIIS module DLLs, and the adminweb2$ account name
- If any IOCs are found, consider isolating affected endpoints per your incident response procedures and conducting forensic investigation to determine scope of compromise
- Consider reviewing IIS web application logs for SQL injection patterns (e.g., UNION SELECT, OR 1=1, xp_cmdshell) on all internet-facing web applications
- If Terminal Services was recently enabled on endpoints where it should not be, consider investigating the change source and disabling if unauthorized
Infrastructure Hardening
- Consider implementing a Web Application Firewall (WAF) with SQL injection detection rules in front of all IIS-hosted applications
- Evaluate whether all web application input fields implement proper parameterized queries and input validation; consider conducting application security testing
- Consider restricting appcmd.exe execution to specific administrative accounts via application control policies
- If supported by your endpoint tooling, consider monitoring and alerting on IIS module installations via appcmd.exe
- Consider implementing network-level blocking for known OAST infrastructure patterns (e.g., oastify.com, oast.fun) if consistent with your security posture
- Evaluate whether MSSQL and IIS should co-locate on the same endpoint; consider separating services to reduce attack surface
User Protection
- Consider deploying application control to restrict execution of unsigned executables from user-writable directories such as C:\users\public\ and C:\ProgramData\
- If your EDR supports it, consider enabling tamper protection for Windows Defender to prevent unauthorized disabling
- Consider monitoring for and alerting on new local account creation, especially accounts added to Administrators group outside of change management windows
- Evaluate whether nssm.exe is required in your environment; if not, consider blocking or restricting its execution via application control
Security Awareness
- Consider incorporating SQL injection awareness into developer training programs, emphasizing parameterized queries and input validation
- If applicable to your organization, consider adding guidance for system administrators on monitoring for unauthorized IIS module installations
- Consider briefing IT teams on the risk of legitimate tools (nssm.exe, attrib.exe, appcmd.exe) being abused for persistence and defense evasion
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping12 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Command and Control
Tactic
Impact
Additional IOCs
- Urls:
hxxp://334thribetlhkyo977gqrcht1k7bvdj2[.]oastify[.]com- Full exfiltration URL receiving tasklist /svc output via Invoke-WebRequest POST
- File Paths:
C:\Program Files (x86)\Microsoft\EdgeUpdate\- Directory where attacker dropped xmr-1.zip, edge.exe, and Taskgmr.ps1 to masquerade as legitimate Edge update filesC:\ProgramData\tjoke\- Directory containing batch file qd_tjoke.bat silently executed via hidden PowerShell processC:\users\public\- Shared user profile directory where initial PowerShell script qdcjoke1.2.ps1 was downloaded
- Command Lines:
- Purpose: Reconnaissance - enumerate running processes and services | Tools:
cmd.exe,tasklist.exe| Stage: Reconnaissance |tasklist /svc - Purpose: Exfiltrate process listing to attacker-controlled OAST domain via HTTP POST | Tools:
powershell.exe,Invoke-WebRequest| Stage: Reconnaissance - Purpose: Install BadIIS malicious modules on IIS web server | Tools:
appcmd.exe| Stage: Persistence - Purpose: Silently execute batch files without visible windows or execution policy restrictions | Tools:
powershell.exe,Start-Process| Stage: Execution - Purpose: Hide cryptocurrency miner files by setting system, hidden, archive, and read-only attributes | Tools:
attrib.exe| Stage: Defense Evasion |attrib.exe +s +h +a +r <filename> - Purpose: Create persistent Windows service for cryptocurrency miner using non-sucking service manager | Tools:
nssm.exe| Stage: Persistence |nssm.exe install <servicename> <exepath> - Purpose: Download XMRig miner archive from Cloudflare R2 storage via WebClient | Tools:
powershell.exe,System.Net.WebClient| Stage: Execution
- Purpose: Reconnaissance - enumerate running processes and services | Tools:
- Other:
adminweb2$- Local user account created by threat actor and added to local Administrators group for persistent access via Terminal Servicesc_joke1.2.ps1- Additional PowerShell payload downloaded by qdcjoke1.2.ps1 scriptTaskgmr.ps1- Cryptocurrency miner-related script placed in C:\Program Files (x86)\Microsoft\EdgeUpdate\ with hidden/system attributesqd_tjoke.bat- Batch file silently executed from C:\ProgramData\tjoke\ via hidden PowerShell process
