huntrule

Suspicious Exchange IIS Worker Loading GhostContainer Module (via image_load)

PremiumReviewedSigma · Medium · v1
Product
windows
Category
image_load
Author
HuntRule
Published
2026-10-06
Updated
2026-10-06
AnalysisDetection

ATT&CK techniques

Persistence

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the Exchange IIS worker process loading the App_Web_Container_1.dll module associated with the GhostContainer backdoor. GhostContainer registers itself as an Exchange component and patches AMSI and ETW in the w3wp process to disable in-memory inspection. Loading this named module in the Exchange worker indicates in-process backdoor persistence on a mail server.

Reporting behind it

Related detections9 linkedT1685 — drag to rearrange
Suspicious Dell DBUtilDrv2 Vulnerable Driver Load via driver_load
Suspicious Service ACL Hardening via sc.exe sdset (via process_creation)
Malicious MOVEit Transfer Exploitation via X-siLock HTTP Headers (via webserver)
Malicious Snatch Ransomware SuperBackupMan SafeBoot Service Registration
Malicious Microsoft Defender Tampering via Registry Values
Malicious Windows Defender DisableAntiSpyware Registry Modification
Malicious Windows Defender Tampering via Set-MpPreference (via ps_script)
Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell
Suspicious Antivirus Uninstallation via msiexec (via process_creation)
Suspicious Exchange IIS Worker Loading GhostContainer Module (via image_load)
Pivot detection · T1685 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.