Web Server Outbound Connections to File Sharing Services

This threat brief details a common post-exploitation technique where attackers, after compromising a web server, utilize the web server's process to download additional malicious tools or payloads from public file-sharing and content hosting websites. The observed behavior involves legitimate web server processes such as httpd.exe, nginx.exe, tomcat.exe, php.exe, or php-cgi.exe initiating outbound network connections to domains like githubusercontent.com, cdn.discordapp.com, pastebin.*, transfer.sh, and mega.nz. This activity is highly suspicious as web servers typically do not require outbound internet access to these types of dynamic or anonymous file hosting services for legitimate operations. Such behavior strongly indicates a prior server compromise, likely through a webshell, reverse shell, or injected task, with the objective of furthering the attacker's foothold and capabilities within the victim's environment. This technique facilitates stealthy ingress tool transfer, bypassing direct download restrictions and leveraging trusted web server processes.

Attack Chain

1. Initial Access (T1190 - Exploit Public-Facing Application): Attackers exploit a vulnerability in a public-facing web server or web application (e.g., Apache HTTP Server, Nginx, Apache Tomcat, PHP application) to gain unauthorized access.
2. Establish Foothold (T1505.003 - Server Software Component: Web Shell): The attacker deploys a webshell or establishes a reverse shell on the compromised web server to maintain persistent access and execute commands.
3. Command and Control (T1071 - Application Layer Protocol): The attacker interacts with the established webshell or reverse shell to issue commands and control the compromised server, often using common application layer protocols like HTTP/S.
4. Ingress Tool Transfer (T1105): The compromised web server process (e.g., httpd.exe, nginx.exe, tomcat.exe) is instructed by the attacker to initiate outbound connections to public file-sharing or content hosting websites (e.g., cdn.discordapp.com, pastebin.com, transfer.sh, githubusercontent.com) to download additional malware, scripts, or post-exploitation tools.
5. Execution (T1059 - Command and Scripting Interpreter): The attacker then executes the newly downloaded tools or malware on the compromised server using various command and scripting interpreters available on the system.
6. Further Objectives (e.g., T1041 - Exfiltration Over C2 Channel, T1486 - Data Encrypted for Impact): The downloaded tools are used to achieve the attacker's ultimate objectives, which may include further lateral movement, data exfiltration, system impact (such as ransomware deployment), or establishing long-term persistence.

Impact

Successful exploitation leading to this behavior signifies a compromised web server, which can have severe consequences. Attackers gain the ability to introduce arbitrary malware, reconnaissance tools, or ransomware onto the server, potentially leading to data breaches, complete system takeover, or disruption of services. The use of web server processes for downloading attacker tools makes detection challenging as it blends with legitimate network traffic. The impact can extend to internal networks if the compromised server provides a pivot point for lateral movement. The number of victims and sectors targeted can vary widely depending on the initial access vector, but web servers are critical assets across almost all organizations.

Recommendation

• Deploy the Sigma rule "Web Server Outbound Download From File Sharing Website" to your SIEM and tune for your environment to detect unexpected outbound connections from web server processes.
• Monitor network connections, specifically outbound traffic originating from web server processes, and review connections to domains listed in the IOC table for suspicious activity.
• Implement strict outbound firewall rules for web servers, allowing connections only to known, legitimate endpoints required for business operations, and block access to the domains listed in the IOC table.
• Ensure Cisco Network Visibility Module flow data is ingested into your SIEM for comprehensive network connection logging to enable the rule above.
• Regularly patch all public-facing web applications and servers to prevent initial access via vulnerabilities like those mentioned in CISA's KEV catalog.