Threat Actors Achieve Persistence After SQL Injection

Huntress describes a real-world June incident where an attacker exploited an SQL injection vulnerability in an IIS-served page to gain access to an endpoint, used base64 PowerShell to download additional scripts, conducted reconnaissance (tasklist/svc exfiltration), created an administrative account and enabled Remote Desktop Services for persistence, installed BadIIS malicious IIS modules and an XMRig cryptocurrency miner (using nssm to run it as a service), and attempted defense evasion by modifying file attributes and disabling Windows Defender; the report highlights the breadth of modifications attackers may perform post-compromise and provides mitigation recommendations such as asset inventory, attack surface reduction, patching, restricted access, and root-cause investigations.