{
  "family": "smallhttp",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Smallhttp refers to highly compact, portable web server executables that are frequently dropped onto compromised machines by attackers during post-exploitation. While web servers are legitimate software, attackers use 'Smallhttp' utilities because they require no installation, leave minimal footprint, and can be instantly bound to a port to facilitate rapid data exfiltration (`T1041`) or internal payload staging for lateral movement.<br><br><b>Understanding Smallhttp (Staging and Exfiltration)</b><br>To an end-user, there is no visible impact. For a SOC analyst, the presence of an unexpected HTTP server running on an endpoint (especially a workstation) is a massive red flag. It indicates the attacker has bypassed initial defenses and is now establishing an internal staging area to move deeper into the network or preparing to steal large volumes of data.<br><br><b>Execution and Exploitation Mechanics</b><br>After gaining a shell on a machine (e.g., via a spearphishing macro or RDP brute force), the attacker drops a tiny HTTP server executable (often only a few kilobytes in size) into a hidden directory. They execute it via the command line, pointing it to a directory containing stolen data (like ZIP files of documents) (`T1560`). The attacker can then simply use `curl` or `wget` from another compromised machine (or externally, if the firewall allows) to download the stolen data over standard port 80/8080, masking the exfiltration as normal web traffic (`T1071.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is usually significant data loss or the facilitation of lateral movement. Host-based IoCs include EDR alerts for unknown executables binding to network ports (listening state) on workstations. Look for processes like `svchost.exe` or `cmd.exe` spawning an unknown binary with command-line arguments specifying a port and directory path. Network IoCs include a sudden spike in outbound HTTP GET requests originating *from* the compromised workstation to external IPs, or unusual internal HTTP traffic between workstations.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1071.001",
    "T1105",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (Using the HTTP server to serve stolen files)",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Serving tools internally to other compromised hosts)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (Disguising data movement as standard HTTP traffic)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; if the server is running, the attacker is actively moving data.",
    "Use `netstat -ano` or EDR tools to identify the specific process bound to the HTTP port and terminate it.",
    "Identify the directory the Smallhttp server was serving to determine exactly what data the attacker was exfiltrating.",
    "Review internal network flows to see if other endpoints downloaded payloads *from* this staging server."
  ],
  "what_to_avoid": [
    "Do not simply kill the process and move on; you must investigate what files were in the web root to understand the scope of the breach.",
    "Avoid relying solely on external firewall logs; if the attacker used the server for internal lateral movement, the traffic never left the network."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}