{
  "family": "smallhttp",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Smallhttp refers to highly compact, portable web server executables that are frequently dropped onto compromised machines by attackers during post-exploitation. While web servers are legitimate software, attackers use 'Smallhttp' utilities because they require no installation, leave minimal footprint, and can be instantly bound to a port to facilitate rapid data exfiltration (`T1041`) or internal payload staging for lateral movement.<br><br><b>Understanding Smallhttp (Staging and Exfiltration)</b><br>To an end-user, there is no visible impact. For a SOC analyst, the presence of an unexpected HTTP server running on an endpoint (especially a workstation) is a massive red flag. It indicates the attacker has bypassed initial defenses and is now establishing an internal staging area to move deeper into the network or preparing to steal large volumes of data.<br><br><b>Execution and Exploitation Mechanics</b><br>After gaining a shell on a machine (e.g., via a spearphishing macro or RDP brute force), the attacker drops a tiny HTTP server executable (often only a few kilobytes in size) into a hidden directory. They execute it via the command line, pointing it to a directory containing stolen data (like ZIP files of documents) (`T1560`). The attacker can then simply use `curl` or `wget` from another compromised machine (or externally, if the firewall allows) to download the stolen data over standard port 80/8080, masking the exfiltration as normal web traffic (`T1071.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is usually significant data loss or the facilitation of lateral movement. Host-based IoCs include EDR alerts for unknown executables binding to network ports (listening state) on workstations. Look for processes like `svchost.exe` or `cmd.exe` spawning an unknown binary with command-line arguments specifying a port and directory path. Network IoCs include a sudden spike in outbound HTTP GET requests originating *from* the compromised workstation to external IPs, or unusual internal HTTP traffic between workstations.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Smallhttp and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Smallhttp is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Smallhttp establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Smallhttp typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Smallhttp compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Smallhttp should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Smallhttp leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Smallhttp frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Smallhttp maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Smallhttp often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1071.001",
    "T1105",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (Using the HTTP server to serve stolen files)",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Serving tools internally to other compromised hosts)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (Disguising data movement as standard HTTP traffic)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; if the server is running, the attacker is actively moving data.",
    "Use `netstat -ano` or EDR tools to identify the specific process bound to the HTTP port and terminate it.",
    "Identify the directory the Smallhttp server was serving to determine exactly what data the attacker was exfiltrating.",
    "Review internal network flows to see if other endpoints downloaded payloads *from* this staging server."
  ],
  "what_to_avoid": [
    "Do not simply kill the process and move on; you must investigate what files were in the web root to understand the scope of the breach.",
    "Avoid relying solely on external firewall logs; if the attacker used the server for internal lateral movement, the traffic never left the network."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}