Telerik UI CVE-2019-18935 — Reverse Shell, Potato Escalation and Godzilla In-Memory Web Shell on IIS

Looks for: The ASEC mitigation guidance names cmd.exe and powershell.exe under w3wp.exe as the abnormal-process pattern after CVE-2019-18935 exploitation. This is the backbone detection of the pack. FP: Some legacy apps shell out on purpose; baseline per application pool.

// HUNT: IIS worker process spawns cmd.exe / PowerShell
// MITRE: T1190, T1059.003, T1059.001
// CONF: high  FP: medium  COST: low
// REQUIRES: Falcon sensor on IIS servers (ProcessRollup2)
// FALSE POSITIVES: legacy ASP.NET applications that deliberately shell out to cmd.exe or PowerShell (report generators, build or deploy hooks)
// TUNING: exclude the specific CommandLine values of known, owner-approved application shell-outs per IIS host and application pool; keep any cmd.exe or powershell.exe child with no CommandLine or with an interactive pattern (whoami, hostname, tasklist, net, systeminfo)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^w3wp\.exe$/i
| FileName=/^(cmd|powershell|pwsh)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, ImageFileName])

Looks for: ASEC observed the operator query the system name (hostname.exe), privileges, and running processes through the reverse shell. Direct w3wp.exe children only; the cmd.exe grandchild case is covered by Q3.

// HUNT: IIS worker child running first-stage recon (hostname, whoami, tasklist ...)
// MITRE: T1033, T1057, T1082, T1018
// CONF: high  FP: low  COST: low
// REQUIRES: Falcon sensor on IIS servers (ProcessRollup2)
// FALSE POSITIVES: monitoring or deployment tooling that runs hostname or whoami from an IIS-hosted admin page; rare on production IIS
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^w3wp\.exe$/i
| FileName=/^(hostname|whoami|tasklist|systeminfo|ipconfig|netstat|net1?|quser|nltest|arp|route|wmic|reg|sc|qwinsta)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

Looks for: Correlates the two documented steps on one host: a cmd.exe spawned by w3wp.exe, and recon binaries spawned by a cmd.exe. Catches the grandchild case Q2 cannot see. FP: Host-level correlation, not exact process-tree.

// HUNT: IIS worker shell followed by recon on the same host (cmd.exe then hostname/whoami/tasklist)
// MITRE: T1033, T1057, T1082
// CONF: high  FP: medium  COST: medium
// REQUIRES: Falcon sensor on IIS servers (ProcessRollup2)
// FALSE POSITIVES: admin consoles or support staff who RDP to the IIS host and run recon commands from an interactive cmd.exe launched by Explorer are excluded by the w3wp.exe parent requirement, but a web admin tool launching cmd.exe then helper tools can match
// TUNING: scope to hosts with the IIS role and exclude the CommandLine values of approved health-check scripts; selfJoinFilter correlates by host (aid), not by exact process-tree, so confirm the cmd.exe PID chain in Falcon before escalating
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| selfJoinFilter(field=[aid], where=[
    {ParentBaseFileName=/^w3wp\.exe$/i FileName=/^cmd\.exe$/i},
    {ParentBaseFileName=/^cmd\.exe$/i FileName=/^(hostname|whoami|tasklist|systeminfo|ipconfig|netstat|net1?|nltest|quser)(\.exe)?$/i}
  ])
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

Looks for: ASEC reports that the Potato tools (including a SweetPotato variant modified for a web-shell environment) use token spoofing such as PrintSpoofer to reach SYSTEM and then launch processes such as cmd.exe with elevated privileges. A SYSTEM-owned child of w3wp.exe is the observable result. FP: Medium only where app pools legitimately run as LocalSystem.

// HUNT: Process running as SYSTEM directly under w3wp.exe (Potato-family token spoofing result)
// MITRE: T1134.001, T1068, T1548
// CONF: high  FP: medium  COST: low
// REQUIRES: Falcon sensor on IIS servers (ProcessRollup2 with UserSid)
// FALSE POSITIVES: IIS application pools deliberately configured to run as LocalSystem (rare, but present on legacy installs)
// TUNING: exclude hosts whose application pool identity is documented as LocalSystem; app pools on ApplicationPoolIdentity or a service account should never directly parent a SYSTEM (S-1-5-18) process
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^w3wp\.exe$/i
| UserSid=S-1-5-18
| table([@timestamp, aid, ComputerName, UserName, UserSid, ParentBaseFileName, FileName, CommandLine, ImageFileName])

Looks for: Matches Potato-family names in the image name or command line. The modified SweetPotato variant may be renamed, so pair with Q4 (SYSTEM child of w3wp.exe) rather than relying on names alone.

// HUNT: Potato-family privilege-escalation tooling (SweetPotato, PrintSpoofer, GodPotato and kin)
// MITRE: T1134.001, T1068
// CONF: high  FP: low  COST: low
// REQUIRES: Falcon sensor on IIS and Windows servers (ProcessRollup2)
// FALSE POSITIVES: authorized penetration tests and red-team exercises; security researchers on lab hosts
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(sweetpotato|printspoofer\d*|godpotato|juicypotato|roguepotato|rottenpotato|efspotato|badpotato|potato)(\.exe)?$/i or CommandLine=/(sweetpotato|printspoofer|godpotato|juicypotato|roguepotato|efspotato)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, ImageFileName, SHA256HashData])

Looks for: ASEC advises checking C:\Users\Public\ and C:\Users\Public\Documents\ for malware, and notes the second case created and ran a scanner file on the target through the exploit payload. TargetFileName is matched on the Public path with the writer limited to w3wp.exe.

// HUNT: Executable or DLL written to C:\Users\Public by an IIS worker process
// MITRE: T1105, T1190, T1505.003
// CONF: high  FP: low  COST: low
// REQUIRES: Falcon sensor on IIS servers (PeFileWritten, NewExecutableWritten)
// FALSE POSITIVES: near none; IIS workers have no routine reason to drop PE files under the Public profile
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| ContextBaseFileName=/^w3wp\.exe$/i
| TargetFileName=/\\Users\\Public\\/i
| table([@timestamp, aid, ComputerName, ContextBaseFileName, TargetFileName, SHA256HashData, MD5HashData])

Looks for: Telerik exploitation delivers a DLL that the vulnerable handler loads (the ASEC article cites prior CVE-2019-18935 cases where a malicious DLL was executed on IIS). This hunt is the broad net for that stage. FP: ASP.NET compilation noise; apply the TUNING exclusion first.

// HUNT: Any PE file written by an IIS worker process (malicious DLL upload), compiler output excluded
// MITRE: T1190, T1105, T1620
// CONF: medium  FP: medium  COST: medium
// REQUIRES: Falcon sensor on IIS servers (PeFileWritten)
// FALSE POSITIVES: ASP.NET dynamic compilation writes DLLs under Temporary ASP.NET Files; deployments and web-publish operations write assemblies into application bin folders
// TUNING: exclude TargetFileName under Temporary ASP.NET Files and compiler-produced paths, and exclude your deployment windows and CI service accounts; investigate what remains (DLLs written to temp, Public, or application upload directories)
#event_simpleName=/^PeFileWritten$/
| ContextBaseFileName=/^w3wp\.exe$/i
| TargetFileName!=/Temporary ASP\.NET Files/i
| table([@timestamp, aid, ComputerName, ContextBaseFileName, TargetFileName, SHA256HashData, MD5HashData])

Looks for: Staging location named in the ASEC mitigation checklist for both incident cases. Direct child of w3wp.exe or cmd.exe from this path raises confidence. FP: Installers; tune by publisher and parent.

// HUNT: Executable launched from C:\Users\Public or C:\Users\Public\Documents
// MITRE: T1204.002, T1036.005
// CONF: medium  FP: medium  COST: low
// REQUIRES: Falcon sensor on Windows servers (ProcessRollup2)
// FALSE POSITIVES: some installers and legacy utilities unpack to the Public profile; Office or collaboration add-ins
// TUNING: exclude signed, known-good publishers and your software-deployment tool by ParentBaseFileName; on IIS servers any hit is worth review, on workstations tune harder
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ImageFileName=/\\Users\\Public\\(Documents\\)?[^\\]+\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

Looks for: Covers the reverse shell (206.82.6.22:80), the staging/target-list hosts on ports 31337 and 31338, and the file URLs the scanner fetches from them. Perishable: re-validate before blocking.

// HUNT: Outbound connection to ASEC-documented C2 addresses
// MITRE: T1071.001, T1095, T1105
// CONF: high  FP: low  COST: low
// REQUIRES: Falcon sensor on all servers (NetworkConnectIP4)
// FALSE POSITIVES: none expected; these addresses are named as attacker infrastructure in the ASEC report. Addresses can be recycled, so verify date and process before concluding compromise
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4=/^(206\.82\.6\.22|65\.98\.5\.158|2\.59\.133\.147|45\.138\.16\.187)$/
| table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, LocalAddressIP4])

Looks for: The ASEC reverse-shell payload opens a TCP socket from the worker process to a public IP on port 80 and then binds cmd.exe to it. Matching w3wp.exe egress to public IPs on the documented 31337/31338 ports or any non-RFC1918 address is the behavioral hook; the port 80 case relies on Q9 for the known address. FP: Legitimate outbound API calls from the app.

// HUNT: IIS worker process connecting outbound on raw high ports or the documented C2 ports
// MITRE: T1095, T1571, T1059.003
// CONF: medium  FP: medium  COST: medium
// REQUIRES: Falcon sensor on IIS servers (NetworkConnectIP4)
// FALSE POSITIVES: web applications calling external APIs, payment gateways, license servers, or CDNs on non-standard ports
// TUNING: exclude the RemoteAddressIP4 and RemotePort pairs of your approved outbound dependencies per application; the reverse shell runs in-process so w3wp.exe is the connecting image, not cmd.exe
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^w3wp\.exe$/i
| !cidr(RemoteAddressIP4, subnet="10.0.0.0/8")
| !cidr(RemoteAddressIP4, subnet="172.16.0.0/12")
| !cidr(RemoteAddressIP4, subnet="192.168.0.0/16")
| !cidr(RemoteAddressIP4, subnet="127.0.0.0/8")
| RemotePort=/^(31337|31338|4444|1337|8080)$/
| table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort])

Looks for: The Rust-based scanner reports found WordPress setup URLs and the public IP to the Telegram API (api.telegram.org). The domain is shared legitimate infrastructure, so it is a behavioral hunt, not an import IOC. The bot token printed in the source report is a credential and is deliberately not shipped. FP: Telegram-based alerting.

// HUNT: Server-side process resolving api.telegram.org (scanner result exfiltration)
// MITRE: T1567, T1041, T1102
// CONF: medium  FP: medium  COST: low
// REQUIRES: Falcon sensor on servers (DnsRequest)
// FALSE POSITIVES: server monitoring or alerting integrations that notify through Telegram bots; admin-installed Telegram clients
// TUNING: exclude the ContextBaseFileName of approved alerting agents; on IIS servers, a w3wp.exe, cmd.exe, powershell.exe, or an unsigned binary under Users\Public resolving this name warrants review
#event_simpleName=DnsRequest
| DomainName=/^api\.telegram\.org$/i
| ContextBaseFileName!=/^(telegram|chrome|msedge|firefox|brave)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, ContextBaseFileName, DomainName])

Looks for: The second ASEC case exploits CVE-2019-18935 and the payload contains only a command that runs the scanner, which pulls a target list (ins.txt) from a remote server. Matches C2 addresses, the staging file names (ins.txt, sm.json, bb.json, cofuz.json) and the WordPress probe paths on any command line.

// HUNT: Scanner or tool command line referencing the documented C2 hosts or target-list files
// MITRE: T1105, T1595.002
// CONF: high  FP: low  COST: low
// REQUIRES: Falcon sensor on Windows servers (ProcessRollup2)
// FALSE POSITIVES: none expected; the strings are specific to the reported campaign infrastructure
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(206\.82\.6\.22|65\.98\.5\.158|2\.59\.133\.147|45\.138\.16\.187|\bins\.txt|\bsm\.json|\bbb\.json|\bcofuz\.json|setup-config\.php|wp-admin.install\.php)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData])

Looks for: Matches the five MD5 values listed in the ASEC IOC section across execution and file-write telemetry. Treat a hit as high confidence, then determine the family by pivoting on the hash.

// HUNT: File hash match: ASEC-published MD5 samples (process start or PE write)
// MITRE: T1105, T1587
// CONF: high  FP: low  COST: low
// REQUIRES: Falcon sensor on all hosts (ProcessRollup2, PeFileWritten, MD5HashData)
// FALSE POSITIVES: none expected for these exact hashes; ASEC does not say which hash maps to which tool (SweetPotato variant, scanner, payload DLL)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| MD5HashData=/^(0a4be0b6c650ffdcd1c22db56f1c4aec|10f705728d228ad949b7894c1a85a2b1|177e34d9174766a1d187a0c82de4c02f|18fb4e070653fc9791e0e408d8cb1c8e|1dbfda02d74b6a7586c4430175204c28)$/i
| table([@timestamp, aid, ComputerName, #event_simpleName, FileName, TargetFileName, MD5HashData, SHA256HashData, CommandLine])