A Huntress investigation shows how an attacker used a SQL injection flaw to gain access, then spent time entrenching on the system by enabling Remote Desktop, creating admin users, disabling Windows Defender, and deploying BadIIS and XMRig. The case highlights that post-breach cleanup is not enough unless defenders also fix the original entry point and harden the environment against repeat access. #Huntress #BadIIS #XMRig
Keypoints
- The attacker entered through an unvalidated web page input that led to SQL injection.
- They performed reconnaissance by listing running services and exfiltrating the results.
- Remote Desktop was enabled, and a new local administrator account was created.
- Windows Defender was disabled, but other security tools such as EDR were left active.
- BadIIS modules and the XMRig miner were installed and configured to persist.