Defence Impairment Olympics

Huntress investigated a web server compromise where attackers uploaded steganographic webshells (multiple .aspx/.php files) and executed a defence-impairment batch script (i.bat) that disabled IIS logging and Microsoft Defender, killed logging/security processes, removed a WAF module, used timestomping, applied IFEO debuggers, attempted WMI-based log clearing, and dumped credentials using Mimikatz-related tools; the report details observed commands, registry modifications, cleanup steps, and provides IoCs and mitigation recommendations.