---
title: Hunt: AhsayCBS / REDCap post-exploitation (webshell → miner) | ctxsec
url: https://ctxsec.com/items/hunt-ahsay
description: ""
status: "hunt idea"
published: 2026-10-13
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-ahsay.md)

hunt idea

2026-10-13

### Hunt: AhsayCBS / REDCap post-exploitation (webshell → miner)

Both campaigns end in web-server-spawned shells and miners. Look for the web service process spawning cmd/powershell/sh, new script files in web roots, and outbound connections to mining pools.

```
// KQL (Defender) sketch
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("java.exe","w3wp.exe","httpd","php-fpm")
| where FileName in~ ("cmd.exe","powershell.exe","sh","bash")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine
```

Tune the parent list to your stack. Sketch only; validate before alerting.

Sources: [Huntress](https://www.huntress.com/blog/ahsaycbs-flaws-exploit) · [Unit 42 (via X)](https://x.com/Unit42_Intel/status/2109811397617992120)