Perimeter products targeted as endpoint defenses strengthen
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Attackers exploit zero-day vulnerabilities in internet-facing perimeter products as endpoint security makes client-side compromise harder.
This NCSC strategic guidance addresses a shift in attacker tactics away from endpoint compromise toward exploitation of internet-facing perimeter infrastructure. As client software has become more secure through defense-in-depth design, sandboxing, and removal of dangerous features (particularly after Microsoft's macro restrictions), attackers have increasingly focused on finding and exploiting vulnerabilities in perimeter-exposed products such as VPNs, firewalls, and file transfer applications. The article notes that many of these vulnerabilities are well-understood classes of web flaws that are trivial to find and exploit, and perimeter products typically lack secure-by-design principles, forensic logging, and the hardening applied to mainstream client software.
The guidance emphasizes that vulnerabilities in perimeter products—such as those historically seen in Ivanti Connect and similar tools—provide attackers perfect footholds into networks where client devices may have strong detective capabilities. Once a vulnerability is known, mass exploitation follows rapidly. The article does not name specific active exploits or zero-day details but establishes the threat model: perimeter products are now a primary attack surface.
Defenders are advised to demand evidence from vendors that products are secure by design before procurement; migrate to cloud-hosted and SaaS equivalents where feasible; disable unnecessary management interfaces and services on internet-facing tools; and aim toward a posture with minimal or no open ports on the perimeter. The underlying message is that fully patched perimeter infrastructure is no longer sufficient defense on its own.
Detection guidance
Web Server Process Spawning Shell With Recon or Download Commands on Linux
Linux web server or reverse-proxy process spawning a shell that runs recon or download-and-execute commands, a typical post-exploitation pattern on exploited internet-facing appliances. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell With Recon or Download Commands on Linux
description: Detects a web server or proxy daemon (nginx, apache, httpd, lighttpd)
spawning a shell whose command line performs reconnaissance or tool download. Behavioural
indicator of exploitation of an internet-facing product (command injection or webshell).
Does not depend on a specific CVE or product.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /nginx
- /apache2
- /httpd
- /lighttpd
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- whoami
- uname -a
- /etc/passwd
- /etc/shadow
- 'curl '
- 'wget '
- 'nc '
- /dev/tcp/
- base64 -d
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Legacy CGI scripts on web servers that legitimately call curl or wget through a
shell
- Vendor appliance management scripts launched by the web service for health checks
level: high
id: cb8572a9-fc12-53b1-a273-321c5ef239e6
status: experimental
author: Vorant
references:
- https://www.ncsc.gov.uk/blog-post/products-on-your-perimeter
IIS Worker Process Spawning Command Shell With Recon Commands
w3wp.exe spawning cmd or PowerShell running discovery commands, indicating exploitation of an internet-facing IIS-hosted application such as a file transfer or VPN portal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IIS Worker Process Spawning Command Shell With Recon Commands
description: Detects w3wp.exe spawning cmd.exe, powershell.exe or pwsh.exe with discovery
or download command lines, a common outcome of exploiting public-facing IIS-hosted
applications such as file transfer or remote access portals.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
CommandLine|contains:
- whoami
- net user
- net group
- ipconfig
- systeminfo
- nltest
- certutil
- bitsadmin
- DownloadString
- 'curl '
condition: selection
falsepositives:
- Web applications that intentionally shell out to run administrative scripts
- Troubleshooting by administrators through a web-based admin console
level: high
id: fa81f11f-394e-51b7-9499-e076319aa3a0
status: experimental
author: Vorant
references:
- https://www.ncsc.gov.uk/blog-post/products-on-your-perimeter
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ncsc.gov.uk/blog-post/products-on-your-perimeter
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,576 reports from 145 sources, 597 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs