Additional methods for detecting malicious code in 1C

In addition to the previous post, we want to talk about some other potential ways of detecting the execution of malicious code in the “1C” system 😳

• First, if the information base is published on a web server, attackers can gain access to it and launch a shell through the web client (screenshot 1).

In this case, we can find useful information in the IIS logs, in particular — access to the information base and loading of an external data processor:

2025-06-17 13:15:20 192.168.80.130 GET /mybase/ - 80 - 192.168.80.129 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/137.0.0.0+Safari/537.36+Edg/137.0.0.0 - 200 0 0 2
Code language: plaintext (plaintext)

2025-06-17 13:18:55 192.168.80.130 GET /mybase/ru/e1cib/logForm cmd=elements&formId=urn:form:ext:0:ce244e8a-6d30-4e49-a244-c6d80d2ea085@n=%22%D0%92%D0%BD%D0%B5%D1%88%D0%BD%D1%8F%D1%8F%D0%9E%D0%B1%D1%80%D0%B0%D0%B1%D0%BE%D1%82%D0%BA%D0%B0.%D0%92%D0%BD%D0%B5%D1%88%D0%BD%D1%8F%D1%8F%D0%9E%D0%B1%D1%80%D0%B0%D0%B1%D0%BE%D1%82%D0%BA%D0%B01%22;v=%223bb1cd7e449b0540951594ef9f12fb6d00000000%22&altFormId=urn:form:ext:8:add30da0-7627-464c-b936-820f49ac3e75@n=%22%D0%92%D0%BD%D0%B5%D1%88%D0%BD%D1%8F%D1%8F%D0%9E%D0%B1%D1%80%D0%B0%D0%B1%D0%BE%D1%82%D0%BA%D0%B0.%D0%92%D0%BD%D0%B5%D1%88%D0%BD%D1%8F%D1%8F%D0%9E%D0%B1%D1%80%D0%B0%D0%B1%D0%BE%D1%82%D0%BA%D0%B01%22;v=%223bb1cd7e449b0540951594ef9f12fb6d00000000%22&sysver=8.3.18.1208&confver=3bb1cd7e449b0540951594ef9f12fb6d00000000&rolesId=0&clang=ru 80 - 192.168.80.129 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/137.0.0.0+Safari/537.36+Edg/137.0.0.0 http://192.168.80.130/mybase/ru/ 200 0 0 37
Code language: plaintext (plaintext)

After decoding the URL of the request above, we will get a string that indicates interaction with an external data processor:
"ВнешняяОбработка.ВнешняяОбработка1";v="3bb1cd7e449b0540951594ef9f12fb6d00000000"

• Another way to detect traces of malicious activity is to analyze the rphost.exe process. If code is executed through 1C_shell, fragments of the external data processor’s code remain in the process memory (screenshot 2).

It is worth noting that this method will not yield results if the server or the rphost.exe process is restarted after the malicious code is executed.

#ir #detect #dfir #malware
@ptescalator