huntrule

Windows IIS aspnet_regiis Decrypts Connection Strings via -pdf

Flags aspnet_regiis.exe runs that target IIS connectionStrings for decryption using -pdf.

FreeUnreviewedSigmahighv1
title: Windows IIS aspnet_regiis Decrypts Connection Strings via -pdf
id: 10ed6362-ac56-4fa2-85ec-100928981b6d
status: test
description: This rule identifies process executions of aspnet_regiis.exe that attempt to decrypt IIS connection strings by using arguments containing "connectionStrings" and " -pdf". Attackers with IIS access (e.g., through a webshell) can use this to recover hardcoded connection string secrets, including service account credentials. It relies on Windows process creation telemetry with the image path or original filename and the command-line contents.
references:
  - https://www.elastic.co/guide/en/security/current/microsoft-iis-connection-strings-decryption.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_iis_connection_strings_decryption.yml
author: Tim Rauch, Elastic (idea), Huntrule Team
date: 2022-09-28
modified: 2022-12-30
tags:
  - attack.credential-access
  - attack.t1003
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    - Image|endswith: \aspnet_regiis.exe
    - OriginalFileName: aspnet_regiis.exe
  selection_args:
    CommandLine|contains|all:
      - connectionStrings
      - " -pdf"
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 97dbf6e2-e436-44d8-abee-4261b24d3e41
    type: derived

What it detects

This rule identifies process executions of aspnet_regiis.exe that attempt to decrypt IIS connection strings by using arguments containing "connectionStrings" and " -pdf". Attackers with IIS access (e.g., through a webshell) can use this to recover hardcoded connection string secrets, including service account credentials. It relies on Windows process creation telemetry with the image path or original filename and the command-line contents.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.