T1505.003 Server Software Component: Web Shells#23
Open
McBeer89 wants to merge 10 commits into
Open
Conversation
McBeer89
changed the title
McBeer89
changed the title
sludgework
previously requested changes
Mar 18, 2026
sludgework
left a comment
sludgework
left a comment
Collaborator
There was a problem hiding this comment.
I'm not kidding when I say this.... GREAT first stab at this. The concepts get into the weeds and lots of moving parts and configurable technologies that you seem to have scoped very nicely.
I would request reviewing a few core concepts that I think either need more detail, or maybe are misleading as written.
Also, I haven't reviewed the DDMs yet for accuracy as I didn't know if implementing any of my requested changes would cause them to be updated as well. I will re-review when you update your version and look at the DDMs then.
Nice work!
dumpst3rfir3
requested changes
Mar 18, 2026
dumpst3rfir3
left a comment
dumpst3rfir3
left a comment
Contributor
There was a problem hiding this comment.
Great work! Lots of great details. I didn't have too much to add to what has been said, and I saw that @sludgework had a lot of feedback on the procedures, so I didn't review those yet (I'll wait for the updated version). Looking forward to the revised draft!
mjwhitta
requested changes
Mar 18, 2026
mjwhitta
left a comment
mjwhitta
left a comment
Contributor
There was a problem hiding this comment.
This is really nice! I have some little things, most of which are unicode related, but I will let @vanvleeta be the decision maker on unicode in TRRs.
This comment was marked as duplicate.
This comment was marked as duplicate.
Sorry, something went wrong.
Author
|
Okay! Thank you everyone! I appreciate the feedback. I think I have addressed everything. Looking forward to more review. |
dumpst3rfir3
previously approved these changes
May 22, 2026
dumpst3rfir3
left a comment
dumpst3rfir3
left a comment
Contributor
There was a problem hiding this comment.
This looks great to me. I had a couple of questions/minor suggestions, but feel free to ignore. Great work
mjwhitta
approved these changes
May 27, 2026
mjwhitta
left a comment
mjwhitta
left a comment
Contributor
There was a problem hiding this comment.
Others may still have some things, but I think it LGTM.
mjwhitta
dismissed
sludgework’s stale review
June 29, 2026 17:04
Requested changes appear to have been made. Two others approved.
…orting docs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Closes all 12 findings from the consolidated peer review and resolves the three audit-research lab items (L1, L2, L3). Lab evidence (test methodologies, findings, captured artifacts) lives in the upstream private working repo and is not synced here. README.md changes: - Scope Statement: adds T1505.004 boundary for IIS module deployments (App_Code\ source / Bin\ DLLs registered as IHttpModule or IHttpHandler) - covered by T1505.004 regardless of delivery, out of scope here. - Technical Background: HTTP.sys observability reworded to factually name the Microsoft-Windows-HttpService ETW provider (Event 1 RecvReq, Event 3 Deliver) rather than implying unobservability; SSI section corrected - #exec cmd= is disabled on IIS 7+ (MS-canonical); n5 "cannot be skipped" softened with a follow-on note that App_Code/Bin modules execute earlier in the Integrated pipeline; frequency qualifiers removed; "most important" superlative dropped; spurious .NET 4.8 pin removed from csc.exe spawn statements (general .NET Framework behavior, not 4.8-specific). - New section "Auto-Execution Triggers" (renamed from "IIS Application Initialization") covers both AppInit warmup requests and global.asax Application_Start / Application_BeginRequest handlers; notes that lifecycle-triggered executions originate inside IIS. - Procedures section: new paragraph on n0/n1 file-prerequisite observability asymmetry (Sysmon 11 only fires on create/overwrite, not in-place modification; Persistence re-use phase produces no file-prerequisite telemetry). - Procedure A: SSI variant removed (#exec cmd= disabled on IIS 7+); ASP.NET and Classic ASP variant code excerpts added. - Procedure B: in-process file-read code excerpt added; explicit compile-on-first-request paragraph for source-form ASP.NET in-process variants; AMSI paragraph scoped to Assembly.Load(byte[]) overload (lab-confirmed AMSI hook), with the "not observed by AMSI" carve-out enumerating in-process .NET COM interop, System.IO, disk-loaded code, and asp.dll-hosted Classic ASP scripts. - Procedure C: compiler-options variant added (subdirectory web.config injecting compiler arguments via system.web/compilation/compilers - lab-verified runtime-reachable on .NET Framework); compile-coverage prose for the pre-compiled DLL variant clarified. - References: added HTTP Server API ETW Tracing, HttpApplication Class, AMSI Integration with Microsoft Defender Antivirus, Assembly.Load Method, What's New in .NET Framework 4.8, and T1505.004 link target. DDM JSON changes (master + per-procedure exports A/B/C): - n4 (Route Request): added labels "Microsoft-Windows-HttpService 1 (RecvReq)" and "Microsoft-Windows-HttpService 3 (Deliver)". - n9: caption renamed from "Call .NET API" (invocation-mechanism name, methodology violation) to "Perform In-Process Operation" (outcome-based, covers .NET API, COM, reflective assembly load); added label "AMSI (AmsiScanBuffer)". - n4.Process and n7.Process: U+2192 (Unicode RIGHTWARDS ARROW) replaced with ASCII "->" for portability. DDM PNGs: regenerated from the updated JSON. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This TRR covers file-based web shells executed through IIS handler mappings on Windows.