--- analysis: 'A single rule for file creation in MemberFiles is prone to noise if users legitimately upload misnamed files. This hunt provides the forensic chain: the boundary probe, then the authentication anomaly from the same IP, then the file write. Correlating across three surfaces confirms the adversarial intent.' blind_spots: - id: missing-iis-logs owner: Infrastructure Team question: Whether the probes were received by the server remediation: Enable IIS W3C logging with URI Stem, URI Query, and Method fields for all public-facing application servers. requires: hb_http_activity logs from the web server risk: If W3C logging is disabled or hb_http_activity is not ingested, the initial probing lead will be lost, and the source IP correlation will fail. stage: web-application-probing-and-brute-force - id: no-file-content-visibility owner: Security Engineering question: What functionality was contained within the uploaded file remediation: Implement an EDR with file content analysis or a WAF that logs the body of multipart/form-data uploads. requires: File content inspection or WAF logs risk: Metadata alone cannot distinguish a functional web shell from a benign file misnamed by a user without manual forensic inspection. stage: webshell-ingress-via-member-upload coverage: - stage: web-application-probing-and-brute-force status: covered steps: - identify-targeted-web-servers - brute-force-sign-ins - stage: webshell-ingress-via-member-upload status: covered steps: - web-shell-file-creations - reason: Belongs to another part of the 'Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers' series. stage: web-worker-shell-execution status: out_of_scope - reason: Belongs to another part of the 'Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers' series. stage: iis-and-web-environment-discovery status: out_of_scope - reason: Belongs to another part of the 'Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers' series. stage: payment-data-harvesting status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Identifying the ingress of web shells on municipal servers prevents the mass harvesting of payment and cardholder data. A negative result confirms the integrity of the application boundary for the recreational platform. methodology: model-assisted trigger: intel-report hypothesis: An intruder has exploited a file upload vulnerability to drop web shells in member-facing directories after probing the application boundary and brute-forcing credentials. labels: - hunt - attack.t1110 - attack.t1190 - attack.t1505.003 - collection - discovery - execution - initial access name: Web Shell Ingress and Platform Probing parameters: lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2026-09-30' ref: default type: number scope_hosts: default: [] description: Target web servers to narrow the search; leave empty to scan the entire estate. from: kind: manual observed: '2026-09-30' ref: analyst-defined type: list[host] webshell_indicators: default: - aa7d-4056-8061-8f32887196b9.aspx - 5893-4e83-a45c-188a5e4686fd.aspx - 2ae9-4d05-ae6d-ad10ccf25ed9.aspx - ed12-4938-9661-f4034526d911.aspx - 8362-42b6-8906-4a33eaaa4bb0.aspx - 5ef0-4da3-b162-01844bf0109e.aspx description: Specific web shell filenames observed in the report. from: kind: article observed: '2026-09-30' ref: huntress-parks-rec type: list[string] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.huntress.com/blog/parks-recreation-platform-webshell-attack gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Focus the hunt on Windows servers running IIS that host the Parks and Recreation management platform. Narrow the lookback to the last 14 days and prioritize hosts exhibiting high-frequency OPTIONS requests or tilde characters in URIs. references: - name: "Huntress \u2014 Determined Attacker Uploads Malicious Webshells to Parks\ \ and Rec Management Platform Servers" url: https://www.huntress.com/blog/parks-recreation-platform-webshell-attack related: - hunt: web-worker-shell-execution reason: This hunt focuses on ingress; the follow-on hunt examines command execution by the IIS worker process after the shell is established. relation: follows scenario: stages: - name: Web Application Probing and Brute Force observables: - POST /management/login.aspx - POST /info/household/login.aspx - GET /a*~1* (IIS 8.3 tilde enumeration) - WebDAV OPTIONS method - Upload.ashx::$DATA - FileUpload.ashx::$DATA slug: web-application-probing-and-brute-force tactic: initial-access techniques: - T1110 - T1190 - name: Webshell Ingress via Member Upload observables: - 'Path: /documents/MemberFiles/' - aa7d-4056-8061-8f32887196b9.aspx - 5893-4e83-a45c-188a5e4686fd.aspx - 2ae9-4d05-ae6d-ad10ccf25ed9.aspx - ed12-4938-9661-f4034526d911.aspx - 8362-42b6-8906-4a33eaaa4bb0.aspx - 5ef0-4da3-b162-01844bf0109e.aspx - 791a-4e96-a5ea-e5c7cfd35fd2.jpg slug: webshell-ingress-via-member-upload tactic: initial-access techniques: - T1190 - T1505.003 - name: Web-Worker Shell Execution observables: - Parent process w3wp.exe spawning cmd.exe - Parent process w3wp.exe spawning powershell.exe - cmd.exe /c whoami - cmd.exe /c net user - cmd.exe /c wmic process where "name='w3wp.exe'" get ProcessId,CommandLine - Import-Module WebAdministration; Get-Website slug: web-worker-shell-execution tactic: execution techniques: - T1059.001 - T1047 - name: IIS and Web Environment Discovery observables: - appcmd.exe list sites - appcmd.exe list vdirs - appcmd.exe list app - dir /b E:\Content\info\App_Code\*DB* - dir /b E:\Content\info\App_Code\*Sql* - C:\inetpub\temp\appPools - C:\Windows\System32\drivers\etc\hosts slug: iis-and-web-environment-discovery tactic: discovery techniques: - T1083 - name: Payment Data Harvesting observables: - findstr /i /c:"connectionString" /c:"password" /c:"Data Source" E:\Content\info\web.config - findstr /s /i /m /c:"CVV" /c:"CardNumber" /c:"CreditCard" E:\Content\info\*.aspx - findstr /s /i /m "AuthorizeNet Fortis CardConnect BluePay PayPal Braintree Stripe" - type E:\Content\info\_fortis\Webhooks\*.txt - findstr /i "exp_date exp_month exp_year expiration cvv first_six last_four card_number" slug: payment-data-harvesting tactic: collection techniques: - T1505.003 summary: A threat actor, likely based in China, compromised multiple instances of a parks and recreation management platform by abusing a legitimate member registration and file upload feature to plant ASPX webshells. Once established, the attacker performed extensive reconnaissance of the IIS environment and local file system, specifically targeting configuration files and Fortis webhook logs to steal payment card data and credentials. series: index: 1 slug: determined-attacker-uploads-malicious-webshells-to-parks-and-rec-management-platform-servers title: Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # Web Shell Ingress and Platform Probing The adversary attempts to breach the web application by probing for vulnerabilities and brute-forcing login pages. This hunt identifies these initial stages by correlating external probing activity with illegitimate file creations on the web server. The hunt fans out these signals to check for the creation of ASPX or ASHX files in known user-writable paths, specifically the /documents/MemberFiles/ directory. An agent then evaluates the combined telemetry to link the external probing IP to the resulting file system artifacts, and the analyst confirms the malicious nature of the uploads to differentiate them from legitimate user activity. ## identify-targeted-web-servers Find web servers receiving tilde enumeration, WebDAV options requests, or high volumes of login traffic to establish a lead. ```sqlite target=web role=scoping params=(lookback_days=lookback_days) ~~~yaml expected: A list of web servers receiving probing requests. High probe counts or the presence of tilde characters indicate active exploitation attempts. reads: - device_hostname - url_path - http_method - src_endpoint_ip - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-10-01' ~~~ SELECT device_hostname, url_path, http_method, src_endpoint_ip, COUNT(*) as probe_count, MIN(time) as first_seen FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%/management/login.aspx%' OR LOWER(url_path) LIKE '%/info/household/login.aspx%' OR url_path LIKE '%~1%' OR url_path LIKE '%::$DATA%' OR http_method = 'OPTIONS') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_path, http_method, src_endpoint_ip ORDER BY probe_count DESC ``` ## corroborate-ingress parallel: - → brute-force-sign-ins - → web-shell-file-creations join: → triage-ingress-evidence ## brute-force-sign-ins Identify high-volume authentication failures to the web platform login pages on the targeted hosts. ```sqlite target=identity role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: prior_equal_window window: '{{lookback_days}}d' expected: A single source IP attempting multiple logins. Failure counts above 10 from one IP against platform pages are highly suspicious. prevalence: by: device_hostname key: - src_endpoint_ip rare_below: 3 reads: - device_hostname - dst_endpoint_name - src_endpoint_ip - actor_user_name - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-10-01' ~~~ SELECT device_hostname, dst_endpoint_name, src_endpoint_ip, actor_user_name, COUNT(*) as failure_count, MIN(time) as first_failure FROM hb_auth_signin WHERE activity_id = 5 AND (LOWER(dst_endpoint_name) LIKE '%/login.aspx%' OR LOWER(dst_endpoint_name) LIKE '%management%' OR LOWER(dst_endpoint_name) LIKE '%household%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_name, src_endpoint_ip, actor_user_name HAVING failure_count > 10 ORDER BY failure_count DESC ``` ## web-shell-file-creations Detect new ASPX or ASHX files in the member upload directory, matching known indicators or patterns. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, webshell_indicators=webshell_indicators, scope_hosts=scope_hosts) ~~~yaml expected: ASPX files appearing in the MemberFiles directory. These are unexpected as member uploads are typically images or documents. reads: - device_hostname - file_path - file_name - process_name - actor_user_name - time silence: evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-10-01' ~~~ SELECT device_hostname, file_path, file_name, process_name, actor_user_name, time FROM hb_file_activity WHERE activity_id = 1 AND (LOWER(file_path) LIKE '%\\documents\\memberfiles\\%' OR LOWER(file_path) LIKE '%/documents/memberfiles/%') AND (LOWER(file_name) LIKE '%.aspx' OR LOWER(file_name) LIKE '%.ashx' OR instr(',' || '{{webshell_indicators}}' || ',', ',' || LOWER(file_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-ingress-evidence ```agent target=hunter cite: required context: - identify-targeted-web-servers - brute-force-sign-ins - web-shell-file-creations max_iterations: 6 objective: Determine if any host exhibits a pattern of external probing (tilde enumeration or OPTIONS requests) or brute-force authentication followed by the creation of an ASPX/ASHX file in the MemberFiles directory. Link these events by source IP and timestamp to confirm if the file upload resulted from a successful exploit or session takeover. success_criteria: A verdict of malicious | suspicious | benign per host with cited rows. tools: - endpoint - identity - web ``` ## route-on-verdict if~: "the triage verdict is malicious for at least one host where boundary probing is linked to a web shell file creation" (confidence: high, judge=hunter) then: → contain-and-remediate-server indeterminate: → forensic-review unavailable: → forensic-review (blind_spot: missing-iis-logs) else: → close-out ## contain-and-remediate-server ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the compromised web server from the network. Delete the malicious ASPX and ASHX files identified in the MemberFiles directory and any other web root directories. Block the source IP addresses identified in the triage stage at the perimeter firewall. ``` → forensic-review ## forensic-review ```manual target=analyst Inspect the MemberFiles directory for the identified ASPX files. Review the file contents for known web shell functions (eval, request, system). Search the HTTP logs for the Simplified Chinese (zh-CN) User Agent string to identify other potentially compromised hosts in the tenant group. ``` → close-out ## close-out ```manual target=analyst Document the source IPs, filenames, and affected hosts. Recommend patching the file upload handler to restrict uploads to specific image/document mime types and enforce filename sanitization. Schedule a follow-on hunt for web worker shell execution (w3wp spawning cmd/powershell). ``` → end