T1505.003 Web Shell or Payload Written into PeopleSoft PSEMHUB.war or PORTAL.war, or MeshAgent Staged in /tmp

File creation of a JSP, JSPX, executable or DLL inside the PeopleSoft PSEMHUB.war or PORTAL.war application directories, or of MeshAgent binaries and configuration in /tmp. After exploiting CVE-2026-35273, UNC6240 (ShinyHunters) writes single-line JSP web shells into PSEMHUB.war (x.jsp for hex-encoded command execution, u.jsp and u2.jsp for chunked uploads, and Neo-reGeorg tunnel.jsp / tunnel.jspx), often as a burst of sequentially numbered files so every node behind a load balancer gets a copy. On Windows it reassembles a 5.2 MB trojanized installer, Ple64.exe (SIDEEYE), in the same directory. On Linux it drops meshagent, meshagent.msh and meshagent.db into /tmp under the PeopleSoft service account. EMHub writes data files under PSEMHUB.war/envmetadata at runtime, but it does not write scripts or binaries, so a new JSP or executable there is the event. Google says to scan both PSEMHUB.war and PORTAL.war, and to check every WebLogic node, not just the first hit.

Intel context

The techniques this rule covers are in use. This is the evidence for them as of November 7, 2026.

Technique	KEV CVEs	Research, 90d	Active families
T1219 Remote Access Tools	1	7	ConnectWise ScreenConnect (abuse), njRAT, AsyncRAT, QuasarRAT
T1505.003 Web Shell	26	7	—

KEV CVEs mapped to this technique

CVEs in CISA KEV that MITRE maps to this technique. They may belong to other campaigns. They show the technique is in use.

CVE	Vendor / Product	EPSS	Ransomware
CVE-2024-21893	Ivanti / Connect Secure, Policy Secure, and Neurons	1.000	ransomware
CVE-2024-21887	Ivanti / Connect Secure and Policy Secure	1.000	ransomware
CVE-2023-32315	Ignite Realtime / Openfire	1.000	—
CVE-2021-44228	Apache / Log4j2	1.000	ransomware
CVE-2022-22954	VMware / Workspace ONE Access and Identity Manager	1.000	ransomware
CVE-2021-26855	Microsoft / Exchange Server	1.000	ransomware
CVE-2023-46805	Ivanti / Connect Secure and Policy Secure	1.000	ransomware
CVE-2022-41082	Microsoft / Exchange Server	1.000	ransomware
CVE-2020-0688	Microsoft / Exchange Server	1.000	ransomware
CVE-2022-22963	VMware Tanzu / Spring Cloud	0.999	—
CVE-2018-4878	Adobe / Flash Player	0.903	ransomware

Research citing this technique

2026-10-30 · Microsoft Threat Intelligence From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
2026-10-29 · Cisco Talos IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
2026-10-26 · Arctic Wolf Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access
2026-10-21 · Elastic Security Labs php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
2026-10-21 · Group-IB Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
2026-10-19 · Rapid7 Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
2026-10-15 · GuidePoint GRIT Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew
2026-10-08 · Huntress Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Malware families using it, named in research (30d): AsyncRAT, ConnectWise ScreenConnect (abuse), QuasarRAT, njRAT.

Rule ID: 630332b3-51f3-526c-b635-b2618660c9c1
Status: experimental
Level: high
Log source: category: file_event
Date: 2026-10-24
Modified: 2026-10-24
ATT&CK: T1219 , T1505.003 (signal rollup)
Canonical YAML: t1505-003-peoplesoft-psemhub-webshell-drop.yml

References

False positives

PeopleTools patching or redeployment rewrites PSEMHUB.war and PORTAL.war. Correlate with a change window; a patch run writes many files at once from the installer, not a handful of JSPs from the WebLogic process.
An administrator deliberately installing MeshCentral agents. A sanctioned install does not land in /tmp under the PeopleSoft account.

Rule YAML

title: 'T1505.003 Web Shell or Payload Written into PeopleSoft PSEMHUB.war or PORTAL.war, or MeshAgent Staged in /tmp'
id: '630332b3-51f3-526c-b635-b2618660c9c1'
status: 'experimental'
description: 'File creation of a JSP, JSPX, executable or DLL inside the PeopleSoft PSEMHUB.war or PORTAL.war application directories, or of MeshAgent binaries and configuration in /tmp. After exploiting CVE-2026-35273, UNC6240 (ShinyHunters) writes single-line JSP web shells into PSEMHUB.war (x.jsp for hex-encoded command execution, u.jsp and u2.jsp for chunked uploads, and Neo-reGeorg tunnel.jsp / tunnel.jspx), often as a burst of sequentially numbered files so every node behind a load balancer gets a copy. On Windows it reassembles a 5.2 MB trojanized installer, Ple64.exe (SIDEEYE), in the same directory. On Linux it drops meshagent, meshagent.msh and meshagent.db into /tmp under the PeopleSoft service account. EMHub writes data files under PSEMHUB.war/envmetadata at runtime, but it does not write scripts or binaries, so a new JSP or executable there is the event. Google says to scan both PSEMHUB.war and PORTAL.war, and to check every WebLogic node, not just the first hit.'
references:
    - 'https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/'
    - 'https://thrunt.me/hunt/shinyhunters/'
    - 'https://attack.mitre.org/techniques/T1505/003/'
    - 'https://attack.mitre.org/techniques/T1219/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-10-24'
modified: '2026-10-24'
tags:
    - 'attack.persistence'
    - 'attack.t1505.003'
    - 'attack.command_and_control'
    - 'attack.t1219'
    - 'cve.2026-35273'
    - 'detection.emerging-threats'
    - 'tlp.clear'
logsource:
    category: 'file_event'
detection:
    selection_psemhub_dir:
        TargetFilename|contains:
            - '/PSEMHUB.war/'
            - '\PSEMHUB.war\'
            - '/PORTAL.war/'
            - '\PORTAL.war\'
    selection_psemhub_ext:
        TargetFilename|endswith:
            - '.jsp'
            - '.jspx'
            - '.exe'
            - '.dll'
    selection_meshagent_tmp:
        TargetFilename:
            - '/tmp/meshagent'
            - '/tmp/meshagent.msh'
            - '/tmp/meshagent.db'
    condition: '(selection_psemhub_dir and selection_psemhub_ext) or selection_meshagent_tmp'
falsepositives:
    - 'PeopleTools patching or redeployment rewrites PSEMHUB.war and PORTAL.war. Correlate with a change window; a patch run writes many files at once from the installer, not a handful of JSPs from the WebLogic process.'
    - 'An administrator deliberately installing MeshCentral agents. A sanctioned install does not land in /tmp under the PeopleSoft account.'
level: 'high'

The YAML file is the rule, and this page displays it. Scripts should read /sigma/manifest.json and fetch t1505-003-peoplesoft-psemhub-webshell-drop.yml directly. The intel context for every rule is in /sigma/evidence.json, keyed by slug.