criticalWeb server log review · 20 minutes

A file transfer appliance wrote a file to itself

The alert, as it arrived

Web server log review

[04:51:33] FILE INTEGRITY · mft-prod-01 · Severity: Critical
New file in web root, owner = service account, not in deployment manifest

  PATH      C:inetpubwwwrootmoveitisapihuman2.aspx
  SIZE      2,517 bytes
  CREATED   04:51:31
  OWNER     NT SERVICEMOVEit DMZ Web

  Preceding 40 minutes, same source IP, same endpoint:
    04:11:02  POST /moveitisapi/moveitisapi.dll   200   len 1284
    04:11:44  POST /moveitisapi/moveitisapi.dll   200   len 1284
    04:12:19  POST /guestaccess.aspx              200   len 903
    ...  (61 further POSTs, near-identical length)

Your turn

Say what happened, in what order, and what you need to establish before anybody says the word "contained".

Write it down before you scroll. The value of this is in committing to an answer you can be wrong about, and reading the breakdown first removes it entirely.

Analyst breakdown

Pro

Unlock the expert breakdown and hunting queries with a Pro membership.

6 steps in order, each with the reasoning and a runnable query, plus the trap most responders fall into on this one and what the incident actually turns out to be. The scenario above stays free and complete: work it first, and the breakdown is worth more.

See what is included Sign in