Initial access brokers (IABs) compromise a network, confirm the access works and sell it. The buyer, often a ransomware affiliate, may arrive days or weeks later. That gap produces two distinct behaviour sets: the broker’s quiet foothold, and a sudden change in who uses it. Detecting either one buys time to evict the access before encryption planning begins.
Signals at a Glance
| Signal | Where | ATT&CK |
|---|---|---|
| Web server worker process spawning a shell or script host | EDR, Sysmon 1 | T1505.003 |
| VPN logon from a new ASN or country for an established user | VPN and identity logs | T1133 |
| Valid account used outside its historical hours or hosts | Windows 4624, IdP | T1078 |
| New remote-management tool installed on a server | EDR, software inventory | T1219 |
| Internal enumeration that begins from a VPN address pool | Firewall, 4624 type 3 | T1018 |
The Broker Foothold
Brokers favour internet-facing servers and stolen VPN or remote-access credentials. A web shell is the quietest persistent foothold, because the parent process is a legitimate web server. Alert when an IIS or Java worker launches a command interpreter:
// Microsoft Defender / Sentinel (KQL) - web server worker spawning a shell
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "tomcat9.exe", "java.exe", "nginx.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "certutil.exe", "whoami.exe")
| summarize cmds=count(), samples=make_set(ProcessCommandLine, 5) by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
// tune/validate: exclude known deployment and health-check scripts per host
The Handoff Moment
When the access is sold, the same credential or shell starts behaving differently: a new source, new hosts, new tooling. Compare each VPN logon to the account’s own history and pair it with the first internal activity that follows:
| tstats count min(_time) as first_seen where index=vpn by VPN.user VPN.src_asn VPN.src_country
| rename VPN.* as *
| eventstats dc(src_asn) as asn_count by user
| where asn_count > 1
| join type=left user [ search index=wineventlog EventCode=4624 Logon_Type=3 earliest=-24h
| stats dc(ComputerName) as hosts_touched by user ]
| where hosts_touched > 10
| table user src_asn src_country first_seen hosts_touched
`comment("tune/validate: field names follow the CIM Authentication/VPN model; adjust to your data")`
- Treat a new remote-management tool (AnyDesk, ScreenConnect and similar) on a server that has no business owner as a foothold until proven otherwise.
- Review web shells on a schedule: new script files in web roots, and web server logs with POST requests to rarely accessed paths that return 200.
- Flag stale accounts that suddenly authenticate; brokers often reuse credentials that nobody monitors.
- Contain on the foothold, not the encryption. Rotating the credential and removing the shell closes the sale before the buyer acts.
SigmaHQ web shell and remote-tool rules, Elastic web shell detections and Splunk ESCU VPN and valid-account analytics are good starting points, alongside CISA #StopRansomware guidance on initial access and generic DFIR Report-style kill-chain write-ups. Baseline your own environment first: who legitimately uses remote tools, and from where.
Build Detections That Fire
Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.
- Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
- Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
- 24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts