Inside a Post-Breach Intrusion: SQL Injection, BadIIS, and Evasion Techniques

Gaining initial access is rarely the final goal for modern threat actors; it is simply the key that unlocks the environment. In a technical breakdown of a June intrusion, security researchers at Huntress detailed how a single unvalidated input field on a web application triggered a cascade of post-compromise activities. Rather than executing a quick data theft or dropping ransomware immediately, the attacker systematically established administrative persistence, disabled built-in endpoint security, turned the hosting web server into an SEO fraud bot, and deployed a hidden cryptocurrency miner.

The incident highlights a critical reality in incident response: surface-level remediation that clears visible malware or disables rogue accounts without closing the original entry vector leaves the organization open to immediate re-entry.

SQL Injection to Full Server Takeover

The compromise originated through a web application hosted on the same server as a Microsoft SQL Server instance. The underlying web page failed to properly sanitize incoming user input, leaving it vulnerable to classic SQL injection (SQLi). By abusing this flaw, the attacker moved beyond querying or altering database contents and leveraged database features—such as xp_cmdshell or equivalent administrative extensions—to execute commands directly against the underlying Windows operating system.

Once shell access was established, the intruder performed immediate, low-noise reconnaissance. Using native administrative utilities, the actor enumerated running Windows services to map the host’s security stack and identify potential service names to impersonate. The output of these enumeration scans was exfiltrated to an actor-controlled server to guide the next phase of the attack.

Defense Evasion and Administrative Persistence

After assessing the host, the attacker took aggressive steps to lock in persistent access and remove defensive obstacles:

1. Remote Desktop Protocol (RDP) Enablement: RDP, which was previously disabled on the server, was programmatically turned on via command-line registry modifications and PowerShell commands.
2. Backdoor Account Creation: The attacker created a new local user account and immediately assigned it to the local Administrators group. They subsequently disconnected their initial web-based shell and logged directly into the server via RDP using these newly minted administrative credentials.
3. Disabling Antivirus: Operating from the interactive RDP session, the attacker disabled Microsoft Windows Defender (typically achieved via PowerShell’s Set-MpPreference -DisableRealtimeMonitoring $true or modifying Defender registry keys). Notably, the attacker failed to disable or tamper with the endpoint detection and response (EDR) agent running on the machine, suggesting reliance on scripted playbooks that specifically target native security features while overlooking third-party security telemetry.

To maintain ongoing command-and-control (C2) and deploy payloads, the actor relied heavily on obfuscated PowerShell execution. Downloads were performed using batch scripts and PowerShell invocations configured with standard evasion parameters (-WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass) to bypass local execution policies and suppress interactive prompts.

Weaponizing IIS with BadIIS and Cryptomining

With elevated privileges secured, the intruder modified the server’s web infrastructure directly by installing malicious extension modules into Internet Information Services (IIS). These components belonged to the BadIIS malware family.

BadIIS functions as a server-side web shell and traffic manipulator. Once registered as a native IIS HTTP module, BadIIS intercepts web traffic processing within the worker process (w3wp.exe). It allows attackers to:

• Inspect incoming HTTP request headers (such as User-Agent and Referer).
• Serve distinct, malicious, or spam content to search engine crawlers (SEO poisoning).
• Inject hidden backlinks or malicious JavaScript payloads into legitimate pages without altering the underlying web files on disk.
• Redirect legitimate site visitors to malicious external targets.

Simultaneously, the attacker monetized the compromised compute resources by dropping an unauthorized cryptocurrency miner. To delay manual discovery by administrators using standard graphical tools like File Explorer, the miner’s binaries were assigned restrictive file attributes (attrib +h +s +r to set Hidden, System, and Read-Only flags). Persistence for the miner was established by registering it as an autostarting Windows Service using legitimate system administration tools, ensuring execution survived host reboots.

Root Cause Remediation and Detection Strategies

Cleaning up an incident of this nature requires defenders to look beyond surface indicators. Simply removing the unauthorized administrative account, killing the cryptomining service, and deregistering the BadIIS module from IIS resolves only the symptoms of the breach. If the vulnerable web application code permitting SQL injection remains unpatched, the threat actor can re-exploit the input field within minutes to recreate administrative backdoors.

To secure systems against similar post-exploitation chains, security teams should implement the following targeted controls:

• Remediate SQL Injection Vulnerabilities: Audit all web applications for unsanitized database queries. Enforce parameterized queries (prepared statements) and stored procedures across all database interactions, and ensure database service accounts operate under the principle of least privilege (e.g., disabling xp_cmdshell on SQL Server).
• Audit IIS Module Registrations: Regularly inspect installed IIS global modules using appcmd.exe list config /section:system.webServer/globalModules or the IIS Manager interface to detect unauthorized DLL registrations associated with malware families like BadIIS.
• Monitor Administrative Account Creation and RDP Activation: Set up alert rules for Event ID 4720 (User Account Created) when paired with Event ID 4728 or 4732 (Member Added to Security Group), especially when originating from non-standard user accounts. Monitor registry modifications under HKLM\System\CurrentControlSet\Control\Terminal Server for remote desktop enablement (fDenyTSConnections set to 0).
• Enforce PowerShell Logging: Enable Script Block Logging (Event ID 4104) and Module Logging to capture obfuscated PowerShell commands employing -ExecutionPolicy Bypass or -WindowStyle Hidden.

Reviewing the entire attack chain—from unvalidated web input to native service persistence—underlines that complete remediation requires tracing every post-exploitation change back to its root cause.