GhostRedirector

GhostRedirector is malware referred to in the provided content as an IIS module, commonly appearing in the analytic story name "GhostRedirector IIS Module and Rungan Backdoor." The available material does not provide a full malware report, but it consistently associates GhostRedirector with abuse of Microsoft IIS components and web-server persistence tradecraft. Specifically, the content links it to MITRE ATT&CK technique T1505.004 (IIS Components), including detections for adding new IIS modules, WebGlobalModule usage, querying installed global modules, module load failures, adding assemblies to the Global Assembly Cache with GACUtil, and disabling HTTP logging. The content also places GhostRedirector in contexts involving exploitation of public-facing applications and web-shell or web-server post-exploitation detections, including Confluence, Ivanti, Exchange web shell, suspicious child processes spawned from web servers, and web or application server processes spawning shells. Additional references associate the GhostRedirector story with remote access software usage, Windows privilege escalation, SQL Server abuse such as xp_cmdshell configuration changes, obfuscated or malicious PowerShell activity, file download via PowerShell, msiexec network communication, curl downloads to suspicious paths, CertUtil decode usage, and RAR SFX file creation. High-confidence information directly present in the content is limited to these defensive and analytic associations; the content does not explicitly identify an infection vector, operator, specific victim sectors, or concrete IOCs for GhostRedirector beyond its repeated characterization as an IIS module tied to the "GhostRedirector IIS Module and Rungan Backdoor" analytic story.