huntrule

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

PremiumReviewedSigma · High · v1
Category
process_creation
Author
HuntRule
Published
2026-08-06
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Initial Access → Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the Samsung MagicINFO application spawning cmd.exe to run reconnaissance commands such as whoami or arp, observed by Huntress following exploitation of the MagicINFO 9 server flaw. Attackers run host and network discovery immediately after gaining code execution through the vulnerable web application. Reconnaissance shells parented by the MagicINFO service indicate active post-exploitation.

Reporting behind it

Related detections9 linkedT1059.003 — drag to rearrange
Malicious WSUS Service Spawning Command Shell via CVE-2025-59287 (via process_creation)
Malicious SharePoint w3wp Spawning Command Shell and PowerShell
Suspicious Host Reconnaissance Command Chain via cmd
Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell
Exchange Worker Process Spawning Command Shell via OWASSRF
Malicious IIS Worker Spawning nslookup via WS_FTP Deserialization
Suspicious SolarWinds Web Help Desk Java Process Spawning Command Shell (via process_creation)
MSSQL Server Process Spawning Command Shell via xp_cmdshell
Malicious Command Shell Spawned by Wing FTP Server Process
Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server
Pivot detection · T1059.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.