I had my clients site just hanging today. It appears a host.txt file was inserted into the root folder.
I run a Windows 2012 R2 server and IIS. The website has anonymous access allowed. I have set the Website Application Pool to run off the local system due to requirements.
I'm unsure how the file got there. It contained all the IIS Bindings of the site, but with different IP addresses.
I'm new to this kind of security and would like to know more about how this happened and how I can prevent it from happening again?