name: JSP Web Shell File Creation in PTC Windchill Codebase on Windows Analytic
signatureid: EDR-SYM962-RUN
category: 'Persistence'
threatname: 'Server Software Component: Web Shell'
functionality: 'Endpoint Management Systems'
description: |
Detects the creation of JSP files within the PTC Windchill
codebase directory tree on Windows Server, which is the single point in the CVE-2026-12569
exploitation chain where either observed web shell family touches disk. Operators write a JSP
web shell into the Windchill codebase login directory using hexadecimal filenames, with sixteen
character names associated with Clop's custom Windchill-aware implant and six character names
associated with a simpler generic command shell. The rule also detects creation of flst.txt, the
file vault enumeration artifact produced by the custom implant's L command.
This is the highest-value endpoint detection available for this campaign on either platform,
because Clop's custom implant executes every built-in command in-process and produces no process
creation telemetry whatsoever. File creation is the only endpoint signal it generates.
Sysmon EVID 11 (file create) is the required telemetry source.
reference:
- https://reliaquest.com/blog/clop-returns-with-custom-implant-in-mass-extortion-campaign/
- https://ransom-isac.org/blog/clop-windchill-flexplm-exploitation/
- https://www.bleepingcomputer.com/news/security/clop-created-custom-web-shell-for-windchill-data-theft-attacks/
- https://github.com/fluffybunnies-h4x/FT-Sysmon-Config
- https://attack.mitre.org/techniques/T1505/003/
- https://attack.mitre.org/techniques/T1190/
labels:
- attack.persistence
- attack.t1505
- attack.t1505.003
- attack.initial_access
- attack.t1190
- attack.collection
- attack.t1083
- Clop
- Cl0p
- FIN11
- CVE_2026_12569
- Windchill
- FlexPLM
- PLM
- Web_Shell
- Mass_Exploitation
logsource:
category: file_modification
product: windows
detection:
selection_windchill_codebase:
FilePath|contains:
- '\Windchill\codebase\'
- '\Windchill\tomcat\instances\'
selection_jsp_write:
FilePath|endswith:
- '.jsp'
selection_login_directory:
FilePath|contains:
- '\codebase\login\'
- '\rfa\jsp\login\'
selection_enumeration_artifact:
FilePath|endswith:
- '\flst.txt'
filter_legitimate_deployment:
# Windchill patching, ant-based deployment, and PTC installer activity legitimately
# write JSP resources into the codebase. Validate against the local install.
Image|endswith:
- '\ant.exe'
- '\msiexec.exe'
- '\7z.exe'
- '\tar.exe'
- '\TrustedInstaller.exe'
condition: ((selection_windchill_codebase and selection_jsp_write) or (selection_login_directory and selection_jsp_write) or selection_enumeration_artifact) and not filter_legitimate_deployment
criticality: Critical
verbose_info:
violation_summary:
grouping_attribute: 'accountname'
level2_attribute: 'devicehostname'
level2_metadata_attributes:
metadata_attributes:TECHNICAL DETAILS
CRITICAL TUNING WARNING -- DO NOT FILTER JAVA AS THE WRITING PROCESS:
The instinctive filter is to exclude java.exe from Image on the reasoning that the
JVM legitimately handles JSP resources. That filter would disable this rule.
The web shell is written by the deserialization gadget executing INSIDE the Method
Server JVM, so java.exe is the writing process for the malicious file. Tomcat's normal
JSP compilation produces .java and .class output in the work directory, not .jsp files
in the codebase. Filter deployment and patching tooling instead.
Detected artifacts:
[0-9a-f]{16}.jsp Clop custom Windchill-aware implant
[0-9a-f]{6}.jsp generic JSP command shell
dpr_[0-9a-f]{8}.jsp family association unconfirmed
flst.txt file vault enumeration output from the implant's L command
Observed filenames at time of reporting (hunt the pattern, not the list):
46b158b8607a4c00.jsp 4b57d0652345d383.jsp 56c9be44a436c4a2.jsp
64652883d9de3299.jsp 7c0a0a34c9d8d53b.jsp ec6ba805a076e709.jsp
Sysmon configuration gap worth closing:
The FT-Sysmon-Config EVENT ID 11 ruleset already includes asp and aspx extensions for
web shell drop detection, which is the correct technique applied to the IIS and .NET
equivalent. This campaign is the argument for extending the same coverage to .jsp.
Any Windows host running Windchill, WebLogic, Tomcat, or JBoss should have .jsp added
and scoped to the application codebase paths:
https://github.com/fluffybunnies-h4x/FT-Sysmon-Config
Why flst.txt matters beyond detection:
It contains vault stream IDs, filenames, storage paths, and file sizes, giving a direct
record of what the operator inventoried. That is a stronger incident scoping input than
the volume claims in an extortion email. Preserve it before remediation.
Hunt window:
Ransom-ISAC assesses zero-day exploitation began in early June 2026. Patches shipped
June 17 and extortion emails began around July 20. A web shell planted before the patch
survives the update, so patch verification alone does not close this out. Scope
searches to June 1 2026 at the latest.
Response guidance on a confirmed hit:
Assume the entire Windchill keystore is exposed. The implant's S command decrypts the
LDAP manager password and every encrypted stored property using the application's own
decryption function. Rotate the LDAP manager password, site administrator keys, and
object storage credentials, and terminate existing sessions, since rotated passwords
leave valid tokens behind. LDAP credentials typically govern Active Directory, email,
and VPN, so a single application compromise can become an enterprise-wide credential
compromise if this step is skipped.
False Positives:
- Low outside change windows. Legitimate JSP writes occur during PTC patching,
upgrades, and customization deployment. Correlate against the change calendar and
prefer time-boxed suppression over permanent filtering, since suppression preserves
the detection afterward.
- Sites deploying custom JSP resources as routine development should narrow the rule to
selection_login_directory alone, which sharply reduces the legitimate write surface.
Policy building walkthrough can be found in this previous post: