Ivanti ICS - Web Shell Drop and Credential Store Access

Georg Lauenstein@gsec

•updated 10 days ago•0•0•1

Detects post-exploitation activity against Ivanti ICS / Connect Secure appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe) drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the CredentialStore / system binaries. These behaviors are the hallmark of attackers converting an authenticated file-write or SSRF into persistent remote code execution and credential theft on edge devices.