{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Threat actors exploited critical web runtime vulnerabilities four days before patches existed. Identifying these breaches requires investigating activity during the October zero-day window across several telemetry surfaces." }, "name": "Pre-Patch Web Runtime Exploitation", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1133", "attack.t1486", "command and control", "execution", "impact", "initial access", "persistence" ], "related": [ { "hunt": "mirai-botnet-persistence-patterns", "reason": "This hunt focuses on the initial zero-day web vector; general Mirai persistence is handled separately.", "relation": "out-of-scope-alternative" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A single rule on shell execution from a web server is useful but lacks the historical context of the zero-day window and the correlation with HTTP status codes and follow-on botnet C2 that this phased hunt provides.", "coverage": [ { "stage": "initial-access-vuln-exploitation", "steps": [ "scope-vulnerable-runtimes", "http-exploitation-attempts" ], "status": "covered" }, { "stage": "unauthenticated-remote-code-execution", "steps": [ "rce-shell-execution" ], "status": "covered" }, { "stage": "botnet-command-and-control", "steps": [ "mirai-botnet-c2" ], "status": "covered" }, { "stage": "external-remote-persistence", "steps": [ "remote-access-persistence" ], "status": "covered" }, { "stage": "data-encryption-impact", "steps": [ "investigate-impact" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "Exploitation of Web Runtimes", "slug": "initial-access-vuln-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2026-111497", "Brotli-compressed streams", "Scanning for PHP 8.1 or older", "Requests targeting Node.js, Bun, or PHP instances", "Attempts captured on 2026-10-17" ] }, { "name": "RCE via Web Server", "slug": "unauthenticated-remote-code-execution", "tactic": "execution", "techniques": [ "T1190" ], "observables": [ "PHP or Node.js processes spawning shells", "/bin/sh", "/bin/bash", "curl or wget used for downloader scripts", "One-line root fix scripts from GitHub" ] }, { "name": "Botnet Communication", "slug": "botnet-command-and-control", "tactic": "command-and-control", "techniques": [ "T1190" ], "observables": [ "Mirai botnet C2 traffic", "Outbound network connections from web server to known botnet IPs" ] }, { "name": "Persistence via Remote Services", "slug": "external-remote-persistence", "tactic": "persistence", "techniques": [ "T1133" ], "observables": [ "Anomalous sign-ins to VPN gateways", "Citrix appliance access patterns following web server compromise" ] }, { "name": "Data Encryption for Impact", "slug": "data-encryption-impact", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "Ransomware encryption on local drives", "Mass file modification on web servers" ] } ], "summary": "Threat actors exploited critical PHP and Brotli vulnerabilities (CVE-2026-111497) during a 'negative window' before official patches were released. The campaign involved mass scanning of internet-facing web runtimes to achieve unauthenticated remote code execution, primarily for botnet recruitment and potential ransomware impact." }, "severity": "critical", "rationale": "Focus on internet-facing servers running PHP or Node.js. Narrow the search to the specific window from Oct 17 to Oct 21, 2026.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An attacker has exploited a zero-day vulnerability in an internet-facing web runtime during the four-day pre-patch window (Oct 17-21, 2026) to gain remote code execution, established botnet C2, and leveraged stolen credentials to persist via remote access services.", "parameters": { "end_date": { "from": { "ref": "sekoia-php2shell", "kind": "article", "observed": "2026-10-21" }, "type": "string", "default": "2026-10-21 23:59:59", "description": "The date the official patch was released." }, "start_date": { "from": { "ref": "sekoia-php2shell", "kind": "article", "observed": "2026-10-17" }, "type": "string", "default": "2026-10-17 00:00:00", "description": "The date active zero-day exploitation was first observed." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Hostnames to focus the investigation; leave empty to hunt across the entire estate." }, "suspicious_ips": { "from": { "ref": "https://www.sekoia.com/blog/php2shell-was-exploited-before-the-patch-expect-more-of-it", "kind": "article", "observed": "2026-10-27" }, "type": "list[ip]", "default": [], "description": "IP addresses identified as suspicious in the first phase; leave empty to search all authentication attempts during the window." }, "runtime_packages": { "type": "list[string]", "default": [ "php", "node", "nodejs", "bun" ], "description": "Package names representing the targeted web runtimes." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.sekoia.com/blog/php2shell-was-exploited-before-the-patch-expect-more-of-it", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.sekoia.com/blog/php2shell-was-exploited-before-the-patch-expect-more-of-it", "name": "PHP2Shell Was Exploited Before the Patch" } ], "blind_spots": [ { "id": "brotli-stream-blindspot", "risk": "Exploit payloads inside valid compressed streams are invisible to hb_http_activity.", "stage": "initial-access-vuln-exploitation", "question": "Was a specifically crafted Brotli-compressed stream used to trigger memory corruption?", "requires": "Full HTTP request body inspection" }, { "id": "no-identity-ip-correlation", "risk": "An attacker using different IPs for RCE and persistence may evade correlation if src_endpoint_ip doesn't match.", "stage": "external-remote-persistence", "question": "Is the external IP used for a VPN sign-in definitely the same as the attacker's beachhead IP?", "requires": "Device-to-Identity IP correlation logs" } ] }, "name": "Pre-Patch Web Runtime Exploitation", "description": "This hunt examines the negative window between the start of active exploitation for vulnerabilities like PHP2Shell and Node2Shell (CVE-2026-111497) and the release of patches on October 21, 2026. Threat actors were observed scanning and exploiting these systems days before a fix existed, meaning patching alone is insufficient for response. The hunt uses a phased approach: first, it identifies exposed runtimes and correlates 500-series web errors with suspicious shell interpreters spawned by web processes. Second, it searches for follow-on botnet communication and anomalous logins to VPN or Citrix gateways from IPs involved in the initial RCE." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "initial-access-vuln-exploitation", "steps": [ "scope-vulnerable-runtimes", "http-exploitation-attempts" ], "status": "covered" }, { "stage": "unauthenticated-remote-code-execution", "steps": [ "rce-shell-execution" ], "status": "covered" }, { "stage": "botnet-command-and-control", "steps": [ "mirai-botnet-c2" ], "status": "covered" }, { "stage": "external-remote-persistence", "steps": [ "remote-access-persistence" ], "status": "covered" }, { "stage": "data-encryption-impact", "steps": [ "investigate-impact" ], "status": "covered" } ], "rationale": "An attacker has exploited a zero-day vulnerability in an internet-facing web runtime during the four-day pre-patch window (Oct 17-21, 2026) to gain remote code execution, established botnet C2, and leveraged stolen credentials to persist via remote access services.", "blind_spots": [ { "id": "brotli-stream-blindspot", "risk": "Exploit payloads inside valid compressed streams are invisible to hb_http_activity.", "stage": "initial-access-vuln-exploitation", "question": "Was a specifically crafted Brotli-compressed stream used to trigger memory corruption?", "requires": "Full HTTP request body inspection" }, { "id": "no-identity-ip-correlation", "risk": "An attacker using different IPs for RCE and persistence may evade correlation if src_endpoint_ip doesn't match.", "stage": "external-remote-persistence", "question": "Is the external IP used for a VPN sign-in definitely the same as the attacker's beachhead IP?", "requires": "Device-to-Identity IP correlation logs" } ], "scoping_notes": "Focus on internet-facing servers running PHP or Node.js. Narrow the search to the specific window from Oct 17 to Oct 21, 2026.", "beyond_detection": "A single rule on shell execution from a web server is useful but lacks the historical context of the zero-day window and the correlation with HTTP status codes and follow-on botnet C2 that this phased hunt provides." } }, { "id": "scope-vulnerable-runtimes", "type": "query", "label": "Scope vulnerable runtimes", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (instr(',' || '{{runtime_packages}}' || ',', ',' || LOWER(package_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_software_inventory", "description": "Identify hosts running targeted web runtimes that were vulnerable during the October 2026 window.", "expected_signal": "A list of hosts and paths where PHP, Node.js or Bun are installed. Silence means these runtimes are not under management." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope vulnerable runtimes", "reads": [ "device_hostname", "package_name", "package_version", "install_path" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (instr(',' || '{{runtime_packages}}' || ',', ',' || LOWER(package_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "A list of hosts and paths where PHP, Node.js or Bun are installed. Silence means these runtimes are not under management.", "verified": "dry-run", "verified_at": "2026-10-29" } }, { "id": "http-exploitation-attempts", "type": "query", "label": "HTTP exploitation attempts", "config": { "dsl": "sqlite", "role": "enrichment", "source": "web", "content": "SELECT device_hostname, src_endpoint_ip, http_method, url_path, status_code, COUNT(*) AS request_count FROM hb_http_activity WHERE (status_code >= 500 OR http_method = 'POST') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (time >= '{{start_date}}' AND time <= '{{end_date}}') GROUP BY device_hostname, src_endpoint_ip, http_method, url_path, status_code ORDER BY request_count DESC", "surface": "hb_http_activity", "description": "Identify HTTP requests targeting web servers that resulted in server errors or heavy POST activity during the zero-day window.", "expected_signal": "Unusual URIs with 500-series errors or high volumes of POST requests. Silence proves absence only if web server logging is enabled." }, "parents": [ { "id": "scope-vulnerable-runtimes" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "HTTP exploitation attempts", "reads": [ "device_hostname", "src_endpoint_ip", "http_method", "url_path", "status_code", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, src_endpoint_ip, http_method, url_path, status_code, COUNT(*) AS request_count FROM hb_http_activity WHERE (status_code >= 500 OR http_method = 'POST') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (time >= '{{start_date}}' AND time <= '{{end_date}}') GROUP BY device_hostname, src_endpoint_ip, http_method, url_path, status_code ORDER BY request_count DESC", "silence": "not_evidence_of_absence", "expected": "Unusual URIs with 500-series errors or high volumes of POST requests. Silence proves absence only if web server logging is enabled.", "verified": "dry-run", "verified_at": "2026-10-29" } }, { "id": "rce-shell-execution", "type": "query", "label": "RCE shell execution", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%/php%' OR LOWER(parent_process_name) LIKE '%/node%' OR LOWER(parent_process_name) LIKE '%/bun%' OR LOWER(parent_process_name) LIKE '%/httpd%' OR LOWER(parent_process_name) LIKE '%/nginx%') AND (LOWER(process_name) LIKE '%/sh' OR LOWER(process_name) LIKE '%/bash' OR LOWER(process_name) LIKE '%/curl' OR LOWER(process_name) LIKE '%/wget') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (time >= '{{start_date}}' AND time <= '{{end_date}}')", "surface": "hb_process_activity", "description": "Detect instances where a web runtime process spawns a shell or downloader, indicating successful unauthenticated execution.", "expected_signal": "A web runtime parent spawning a shell or network utility. This is highly suspicious during a zero-day window." }, "parents": [ { "id": "scope-vulnerable-runtimes" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "RCE shell execution", "reads": [ "device_hostname", "process_name", "process_cmd_line", "parent_process_name", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%/php%' OR LOWER(parent_process_name) LIKE '%/node%' OR LOWER(parent_process_name) LIKE '%/bun%' OR LOWER(parent_process_name) LIKE '%/httpd%' OR LOWER(parent_process_name) LIKE '%/nginx%') AND (LOWER(process_name) LIKE '%/sh' OR LOWER(process_name) LIKE '%/bash' OR LOWER(process_name) LIKE '%/curl' OR LOWER(process_name) LIKE '%/wget') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (time >= '{{start_date}}' AND time <= '{{end_date}}')", "silence": "evidence_of_absence", "expected": "A web runtime parent spawning a shell or network utility. This is highly suspicious during a zero-day window.", "verified": "dry-run", "verified_at": "2026-10-29" } }, { "id": "triage-exploitation", "type": "analytic", "label": "Triage early exploitation", "config": { "cite": "required", "tools": [ "endpoint", "identity", "network", "web" ], "context": [ "scope-vulnerable-runtimes", "http-exploitation-attempts", "rce-shell-execution" ], "objective": "Determine if any host with a web runtime shows signs of unauthenticated remote code execution citing HTTP errors and shell spawning.", "description": "Evaluate whether any host shows signs of successful zero-day compromise based on web errors and process execution.", "max_iterations": 4, "expected_signal": "A verdict per host on the likelihood of successful unauthenticated code execution.", "success_criteria": "Verdicts citing the specific web runtime and the subsequent shell commands." }, "parents": [ { "id": "http-exploitation-attempts", "kind": "merge" }, { "id": "rce-shell-execution", "kind": "merge" } ] }, { "id": "mirai-botnet-c2", "type": "query", "label": "Mirai botnet C2", "config": { "dsl": "sqlite", "role": "baseline", "source": "network", "content": "SELECT dst_endpoint_ip, dst_endpoint_port, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (time >= '{{start_date}}' AND time <= '{{end_date}}') GROUP BY dst_endpoint_ip, dst_endpoint_port HAVING host_count <= 2 ORDER BY host_count ASC", "surface": "hb_network_connection", "description": "Detect outbound connections to rare external IPs, indicative of a botnet agent established via the RCE.", "expected_signal": "Outbound connections to unique IPs. Mirai often targets non-standard ports (23, 2323) but may use 80/443." }, "parents": [ { "id": "triage-exploitation" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Mirai botnet C2", "reads": [ "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "direction", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT dst_endpoint_ip, dst_endpoint_port, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (time >= '{{start_date}}' AND time <= '{{end_date}}') GROUP BY dst_endpoint_ip, dst_endpoint_port HAVING host_count <= 2 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "5d", "compare": "first_seen" }, "expected": "Outbound connections to unique IPs. Mirai often targets non-standard ports (23, 2323) but may use 80/443.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "dst_endpoint_ip" ], "rare_below": 3 }, "verified_at": "2026-10-29" } }, { "id": "remote-access-persistence", "type": "query", "label": "Remote access persistence", "config": { "dsl": "sqlite", "role": "triage", "source": "identity", "content": "SELECT actor_user_name, src_endpoint_ip, provider, dst_endpoint_name, time FROM hb_auth_signin WHERE (instr(',' || '{{suspicious_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 OR '{{suspicious_ips}}' = '') AND status_id = 1 AND (time >= '{{start_date}}' AND time <= '{{end_date}}')", "surface": "hb_auth_signin", "description": "Identify successful sign-ins to VPN or Citrix gateways from IP addresses involved in the RCE or botnet activity.", "expected_signal": "Successful logons to gateways from external IPs identified as suspicious. This indicates credential reuse or theft." }, "parents": [ { "id": "triage-exploitation" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Remote access persistence", "reads": [ "actor_user_name", "src_endpoint_ip", "provider", "dst_endpoint_name", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT actor_user_name, src_endpoint_ip, provider, dst_endpoint_name, time FROM hb_auth_signin WHERE (instr(',' || '{{suspicious_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 OR '{{suspicious_ips}}' = '') AND status_id = 1 AND (time >= '{{start_date}}' AND time <= '{{end_date}}')", "silence": "not_evidence_of_absence", "expected": "Successful logons to gateways from external IPs identified as suspicious. This indicates credential reuse or theft.", "verified": "dry-run", "verified_at": "2026-10-29" } }, { "id": "triage-intrusion", "type": "analytic", "label": "Triage intrusion chain", "config": { "cite": "required", "tools": [ "endpoint", "identity", "network", "web" ], "context": [ "triage-exploitation", "mirai-botnet-c2", "remote-access-persistence" ], "objective": "Confirm whether the RCE beachhead was used to establish botnet C2 or pivot to external remote services.", "description": "Synthesize early RCE evidence with follow-on C2 and persistence findings to confirm a multi-stage intrusion.", "max_iterations": 6, "expected_signal": "A detailed timeline linking zero-day exploitation to botnet activity or gateway access.", "success_criteria": "A final verdict identifying compromised hosts, IPs, and accounts with high confidence." }, "parents": [ { "id": "mirai-botnet-c2", "kind": "merge" }, { "id": "remote-access-persistence", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-intrusion verdict is malicious for at least one host", "condition": "the triage-intrusion verdict is malicious for at least one host", "blind_spot": "brotli-stream-blindspot", "confidence": "high", "description": "Determine the response path based on the triage-intrusion results.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-intrusion" } ] }, { "id": "isolate-and-revoke", "type": "action", "label": "Isolate and revoke", "config": { "target": "endpoint", "description": "Contain the compromise by isolating the host and revoking sessions.", "instructions": "Isolate the compromised web server from the network and revoke any active VPN or Citrix sessions associated with the user accounts involved in the suspicious sign-ins.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "investigate-impact", "type": "task", "label": "Investigate impact", "config": { "assignee": "analyst", "description": "Determine the extent of damage, including potential data encryption or unauthorized file access.", "instructions": "Review hb_file_activity on the compromised host for mass modification or renaming (ransomware indicators) and check shell_history for commands executed by the attacker." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-and-revoke" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Verify patching status and document the zero-day incident.", "instructions": "Confirm that all web runtimes identified in the scoping step have been patched to versions released on or after October 21, 2026. Document any gaps in log visibility found during the triage." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "investigate-impact" } ] } ] }