cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

Huntress Details SQL Injection Attack and Attacker’s Post-Compromise Activity

· Original article ↗

Summary

Huntress describes an attacker entering a Windows server through SQL injection, then enabling Remote Desktop, creating an admin account, disabling Defender, and installing BadIIS and XMRig. It urges fixing the entry point as well as removing payloads.

Key points

  • Huntress traced the attacker’s access to a web page that failed to validate input, enabling SQL injection against a Windows server.
  • The attacker enumerated running services and sent the results to a server they controlled.
  • They enabled Remote Desktop, created and used a local administrator account, and disabled Windows Defender; other security monitoring tools remained active.
  • The attacker installed BadIIS modules on the IIS web server, which can be used to manipulate website traffic.
  • They deployed XMRig as a Windows service for persistence, hid its files, and installed an additional detection-evasion tool.
  • The attacker downloaded PowerShell scripts and batch files and ran PowerShell silently with execution-policy restrictions bypassed.
  • Huntress recommends addressing the original SQL injection flaw as well as removing attacker tools, and also advises reducing exposed services, using MFA, and maintaining patching and monitoring.

Article Details

Attack Vectors
  • An unvalidated web-page input enabled SQL injection, which the attacker used to access the underlying Windows machine.
  • After gaining access, the attacker listed running services and sent the results to a server they controlled.
  • The attacker enabled Remote Desktop, created a local account, added it to the local Administrators group, and used it to log in.
  • The attacker disabled Windows Defender and installed BadIIS modules on the IIS web server.
  • The attacker installed XMRig for cryptocurrency mining, configured it to run as a Windows service, and used file attributes to hide its files.
  • The attacker downloaded PowerShell scripts and batch files from external servers and ran PowerShell silently, bypassing script execution policies.
Defensive Notes
  • Fix the original SQL injection flaw as part of incident response; removing malware and accounts without closing the entry point may allow re-entry.
  • Maintain an inventory of systems, applications, and versions; reduce exposed services, and remove unnecessary or unauthorized items.
  • Restrict access to authorized users and use multi-factor authentication wherever possible.
  • Patch active applications regularly and include them in monitoring coverage.
  • Investigate the root cause of incidents rather than stopping after removing obvious malware.

MITRE ATT&CK

T1007 · System Service DiscoveryThe attacker listed running services on the compromised machine during reconnaissance.T1021.001 · Remote Desktop ProtocolThe attacker enabled Remote Desktop and logged in using the newly created account.T1059.001 · PowerShellThe attacker used PowerShell to run downloaded scripts silently and bypass Windows script execution policies.T1098.007 · Additional Local or Domain GroupsThe attacker added the new account to the local Administrators group.T1105 · Ingress Tool TransferThe attacker downloaded PowerShell scripts and batch files from external servers.T1136.001 · Local AccountThe attacker created a new local user account on the compromised machine.T1190 · Exploit Public-Facing ApplicationThe attacker used SQL injection through an unvalidated web-page input to access the underlying Windows machine.T1496 · Resource HijackingThe attacker deployed XMRig to use the compromised machine for cryptocurrency mining.T1505.004 · IIS ComponentsThe attacker installed BadIIS modules on the IIS web server.T1543.003 · Windows ServiceThe attacker configured the miner to run as a Windows service so it would start automatically and persist across reboots.T1562.001 · Disable or Modify ToolsThe attacker disabled Windows Defender.T1564.001 · Hidden Files and DirectoriesThe attacker marked the miner's files as hidden, system, and read-only to make them less visible.T1564.003 · Hidden WindowThe attacker ran PowerShell with no visible windows.

Malware

BadIISon the system by enabling Remote Desktop, creating admin users, disabling Windows Defender, and deploying BadIIS and XMRig.XMRigby enabling Remote Desktop, creating admin users, disabling Windows Defender, and deploying BadIIS and XMRig.

Vendors

MicrosoftHuntress’ security team first noticed suspicious activity tied to a Microsoft SQL Server process.

Products

Internet Information Services (IIS)The attacker then installed a couple of malicious add-ons for the Internet Information Services (IIS) web server software running on the machine.Microsoft SQL ServerHuntress’ security team first noticed suspicious activity tied to a Microsoft SQL Server process.PowerShellThroughout the attack, the intruder downloaded a series of PowerShell scripts and batch files from external servers, a common way to bring in additional malicious tools without having to include everything in theWindows Defenderspent time entrenching on the system by enabling Remote Desktop, creating admin users, disabling Windows Defender, and deploying BadIIS and XMRig.

Related Articles