Possible C:\inetpub "debugging"

[mrjohnjennings]

Curious is anyone has tried a tool like, https://github.com/TechieGuy12/FileWatcher to just have something watch that folder and seeing if it's a quick "catch and release" where something is being put there and windows defender makes it disappear instantly. It kinda seems like a "canary" approach, where we know you target this folder and it's now high on the WinDef list of "keep an eye on this", As on the last podcast I think making it hidden would have been the smart approach, average user wouldn't see it. Anyways, still curious to find out what's going on there.

Yes, I am a new member, but have been listening to SecurityNow since Highschool (39 now), also without saying too much Screensavers and one of Kevin Rose's dark tips about Cain & Abel was a game changer. needless to say I didn't use my powers for evil when I got god mode over a weak system password for AV vadmin/infection. helped a few friends and ultimately told the head of the dept anonymously, hey you need to change this damn password.

 

[PHolder]

I thought I read somewhere that the folder was put in place to prevent the existence of a folder junction or similar (what passes for a soft link in [Lin](U)nix terms.) It's clearly not the "correct" fix, just something quick and dirty that an intern threw together.

 

[mrjohnjennings]

I thought I read somewhere that the folder was put in place to prevent the existence of a folder junction or similar (what passes for a soft link in [Lin](U)nix terms.) It's clearly not the "correct" fix, just something quick and dirty that an intern threw together.

Yeah, just wasn't sure and similar to steve when talking about it, I was like, this could have easily been a powershell script. Wasn't ruling out it's a potential honeypot attempt, but at least don't make it obvious. Lack of info and being cagey about it, perhaps not giving details to the bad guys? Was just spitballing ideas. Who knows, maybe it was an intern. Might have been rolled out but to try and roll it back by doing any mods to the inetpub folder would be a horrific disaster.