{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "SonicWall SMA zero-day exploitation represents a critical perimeter breach. Identifying the UTA0533 tradecraft is essential to preventing lateral movement and credential theft from internal directory services." }, "name": "SonicWall Appliance Zero-Day Exploitation and Webshells", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1090.003", "attack.t1505.003", "attack.t1572", "attack.t1133" ], "related": [ { "hunt": "edge-device-persistence-forensics", "reason": "This hunt focuses on current telemetry; a full forensic investigation of disk images is needed for deep recovery.", "relation": "out-of-scope-alternative" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A standard detection rule might alert on /wsproxy, but this hunt correlates the successful bypass (status 101) with behavioral couchdb shell execution and rare API persistence, providing a full narrative that a single alert cannot achieve.", "coverage": [ { "stage": "pre-authentication-proxy-bypass", "steps": [ "wsproxy-bypass-search" ], "status": "covered" }, { "stage": "privilege-escalation-and-rce", "steps": [ "couchdb-rce-search" ], "status": "covered" }, { "stage": "persistence-via-webshell-and-nginx", "steps": [ "webshell-prevalence-search" ], "status": "covered" }, { "stage": "credential-sniffing-and-lateral-movement", "steps": [ "fingerprint-search", "lateral-movement-auth" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "Pre-authentication WebSocket Proxying", "slug": "pre-authentication-proxy-bypass", "tactic": "initial-access", "techniques": [ "T1190", "T1090.003" ], "observables": [ "GET /wsproxy?bmID=-3389", "User-Agent: SMA Connect Agent", "HTTP 101 Switching Protocols", "Destination ports 1050, 1051, 8188 on 127.0.0.1" ] }, { "name": "CVE-2026-15410 Command Injection", "slug": "privilege-escalation-and-rce", "tactic": "execution", "techniques": [ "T1190" ], "observables": [ "/tmp/1234.sh", "couchdb user executing shell scripts", "/usr/local/bin/remove_hotfix ../../../../../tmp/1234.sh", "running hotfix removal in ctrl-service.log" ] }, { "name": "Webshell and Nginx Persistence", "slug": "persistence-via-webshell-and-nginx", "tactic": "persistence", "techniques": [ "T1505.003" ], "observables": [ "python3 /usr/lib/python3.11/site-packages/deploy_new.py", "POST /__api__/login", "POST /__api__/logout", "Nginx configuration rewrites to malicious endpoints" ] }, { "name": "LDAP Sniffing and Lateral Movement", "slug": "credential-sniffing-and-lateral-movement", "tactic": "credential-access", "techniques": [ "T1133", "T1572" ], "observables": [ "nohup tcpdump -i any port 389", "User-Agent: Chrome/149.0.0.1", "Authentication attempts from VPN appliance IP", "Lateral movement to internal directory servers" ] } ], "summary": "UTA0533 compromised SonicWall SMA 1000 appliances by exploiting a zero-day pre-authentication bypass to tunnel traffic to internal services like CouchDB and a management control service. They achieved root-level code execution via command injection, established persistence through modified nginx configurations and Python-based webshells, and performed credential sniffing of LDAP traffic to move laterally." }, "severity": "critical", "rationale": "Initial focus should be on all SonicWall SMA 1000 series appliances identified by vulnerability scanners. Map the resource_uid from findings to hostnames before running telemetry queries.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has exploited a pre-authentication proxy bypass and CVE-2026-15410 to execute commands on a SonicWall SMA appliance, established persistence via Nginx rewrites, and moved laterally using specific browser fingerprints.", "parameters": { "target_cve": { "from": { "ref": "Volexity UTA0533", "kind": "article", "observed": "2026-07-17" }, "type": "string", "default": "CVE-2026-15410", "description": "CVE identifier for the SMA AMC Code Injection." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Narrow the hunt to specific appliance hostnames." }, "malicious_ua": { "from": { "ref": "Volexity UTA0533", "kind": "article", "observed": "2026-07-17" }, "type": "string", "default": "Mozilla/6.0 (Windows NT 11.0; Win64; x64) AppleWebKit/1537.136 (KHTML, like Gecko) Chrome/149.0.0.1 Safari/1537.136", "description": "Hardcoded User-Agent observed during lateral movement." }, "appliance_ips": { "from": { "ref": "https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/", "kind": "article", "observed": "2026-09-09" }, "type": "list[ip]", "default": [], "description": "Internal IPs of the VPN appliances to track outbound movement." }, "lookback_days": { "from": { "ref": "incident-window", "kind": "manual", "observed": "2026-06-22" }, "type": "number", "default": "30", "description": "Days of history to examine." }, "service_accounts": { "type": "list[string]", "default": [ "svc-sonicwall", "radius-user" ], "description": "Known service accounts used by the appliance for synchronization." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/", "name": "Proxying to Compromise: SonicWall SMA 0-day Exploitation" } ], "blind_spots": [ { "id": "limited-edge-telemetry", "risk": "Standard HTTP telemetry records the tunnel creation but not the traffic within the tunnel, potentially missing the specific internal targeting.", "stage": "pre-authentication-proxy-bypass", "question": "Which specific internal services were accessed through the WebSocket tunnel?", "requires": "appliance-native logging for /var/log/aventail" }, { "id": "nginx-config-persistence", "risk": "If the EDR does not monitor the appliance's specific configuration directories, the establishment of the persistent webshell path may go unnoticed.", "stage": "persistence-via-webshell-and-nginx", "question": "When were the malicious rewrite rules added to the firmware configuration?", "requires": "hb_file_activity covering nginx configuration paths" } ] }, "name": "SonicWall Appliance Zero-Day Exploitation and Webshells", "description": "The adversary exploits SonicWall SMA 1000 series appliances using a zero-day chain to gain initial access and establish persistent webshells. The hunt identifies UTA0533 intrusion patterns by scoping vulnerable devices and searching for successful /wsproxy bypasses and CouchDB-based shell execution. A follow-on phase detects persistent access through rare API endpoints and tracks lateral movement attempts originating from the appliance. This phased approach ensures that the hunt prioritizes follow-on indicators for hosts showing signs of initial exploitation." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "pre-authentication-proxy-bypass", "steps": [ "wsproxy-bypass-search" ], "status": "covered" }, { "stage": "privilege-escalation-and-rce", "steps": [ "couchdb-rce-search" ], "status": "covered" }, { "stage": "persistence-via-webshell-and-nginx", "steps": [ "webshell-prevalence-search" ], "status": "covered" }, { "stage": "credential-sniffing-and-lateral-movement", "steps": [ "fingerprint-search", "lateral-movement-auth" ], "status": "covered" } ], "rationale": "An adversary has exploited a pre-authentication proxy bypass and CVE-2026-15410 to execute commands on a SonicWall SMA appliance, established persistence via Nginx rewrites, and moved laterally using specific browser fingerprints.", "blind_spots": [ { "id": "limited-edge-telemetry", "risk": "Standard HTTP telemetry records the tunnel creation but not the traffic within the tunnel, potentially missing the specific internal targeting.", "stage": "pre-authentication-proxy-bypass", "question": "Which specific internal services were accessed through the WebSocket tunnel?", "requires": "appliance-native logging for /var/log/aventail" }, { "id": "nginx-config-persistence", "risk": "If the EDR does not monitor the appliance's specific configuration directories, the establishment of the persistent webshell path may go unnoticed.", "stage": "persistence-via-webshell-and-nginx", "question": "When were the malicious rewrite rules added to the firmware configuration?", "requires": "hb_file_activity covering nginx configuration paths" } ], "scoping_notes": "Initial focus should be on all SonicWall SMA 1000 series appliances identified by vulnerability scanners. Map the resource_uid from findings to hostnames before running telemetry queries.", "beyond_detection": "A standard detection rule might alert on /wsproxy, but this hunt correlates the successful bypass (status 101) with behavioral couchdb shell execution and rare API persistence, providing a full narrative that a single alert cannot achieve." } }, { "id": "identify-vulnerable-appliances", "type": "query", "label": "Identify vulnerable SMA appliances", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT resource_uid, device_uid, affected_package_version, severity, first_seen FROM hb_vulnerability_finding WHERE cve_uid = '{{target_cve}}' AND status != 'suppressed'", "surface": "hb_vulnerability_finding", "description": "Locate appliances in the estate currently reporting the target CVE to define the hunt scope.", "expected_signal": "A list of resource_uid identifiers. The analyst must map these cloud ARNs or provider IDs back to device_hostname values using the hb_devices table before proceeding to subsequent steps." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify vulnerable SMA appliances", "reads": [ "resource_uid", "device_uid", "affected_package_version", "severity", "first_seen", "cve_uid", "status" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT resource_uid, device_uid, affected_package_version, severity, first_seen FROM hb_vulnerability_finding WHERE cve_uid = '{{target_cve}}' AND status != 'suppressed'", "silence": "not_evidence_of_absence", "expected": "A list of resource_uid identifiers. The analyst must map these cloud ARNs or provider IDs back to device_hostname values using the hb_devices table before proceeding to subsequent steps.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "wsproxy-bypass-search", "type": "query", "label": "WebSocket proxy bypass attempts", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "web", "content": "SELECT device_hostname, src_endpoint_ip, url_full, status_code, time FROM hb_http_activity WHERE url_path = '/wsproxy' AND status_code = 101 AND (url_query LIKE '%bmID=-3389%' OR user_agent = 'SMA Connect Agent') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Detect successful external attempts to tunnel through /wsproxy to internal management ports.", "expected_signal": "Requests to /wsproxy returning status 101, confirming a successful protocol upgrade for a proxy bypass as described in the report." }, "parents": [ { "id": "identify-vulnerable-appliances" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "WebSocket proxy bypass attempts", "reads": [ "device_hostname", "src_endpoint_ip", "url_full", "status_code", "time", "url_path", "url_query", "user_agent" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, src_endpoint_ip, url_full, status_code, time FROM hb_http_activity WHERE url_path = '/wsproxy' AND status_code = 101 AND (url_query LIKE '%bmID=-3389%' OR user_agent = 'SMA Connect Agent') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Requests to /wsproxy returning status 101, confirming a successful protocol upgrade for a proxy bypass as described in the report.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "couchdb-rce-search", "type": "query", "label": "CouchDB behavioral RCE search", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(user_name) = 'couchdb' AND (LOWER(process_name) IN ('sh', 'bash', 'dash', 'python', 'python3', 'php') OR LOWER(process_cmd_line) LIKE '%/tmp/%')) OR LOWER(process_cmd_line) LIKE '%remove_hotfix%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify anomalous shell activity spawned by the couchdb user account, regardless of the filename used.", "expected_signal": "Any row showing the couchdb service account spawning a command shell or an interpreter, which indicates successful command injection." }, "parents": [ { "id": "identify-vulnerable-appliances" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "CouchDB behavioral RCE search", "reads": [ "device_hostname", "user_name", "process_name", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(user_name) = 'couchdb' AND (LOWER(process_name) IN ('sh', 'bash', 'dash', 'python', 'python3', 'php') OR LOWER(process_cmd_line) LIKE '%/tmp/%')) OR LOWER(process_cmd_line) LIKE '%remove_hotfix%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Any row showing the couchdb service account spawning a command shell or an interpreter, which indicates successful command injection.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "exploitation-analysis", "type": "analytic", "label": "Evaluate exploitation success", "config": { "cite": "required", "tools": [ "endpoint", "identity", "web" ], "context": [ "wsproxy-bypass-search", "couchdb-rce-search" ], "objective": "Confirm if any appliance in scope exhibits both the successful /wsproxy bypass (101 status) and post-exploit command execution from the couchdb user.", "description": "Assess whether the observed web traffic and process activity confirm a successful breach of the appliance.", "max_iterations": 3, "expected_signal": "A per-host verdict confirming the exploit chain success.", "success_criteria": "A list of compromised hosts with specific evidence of both bypass and behavioral shell execution." }, "parents": [ { "id": "wsproxy-bypass-search", "kind": "merge" }, { "id": "couchdb-rce-search", "kind": "merge" } ] }, { "id": "webshell-prevalence-search", "type": "query", "label": "Rare API path persistence", "config": { "dsl": "sqlite", "role": "baseline", "source": "web", "content": "SELECT url_path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_http_activity WHERE url_path LIKE '/__api__/%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY url_path HAVING host_count < 3 ORDER BY host_count ASC", "surface": "hb_http_activity", "description": "Identify undocumented /__api__/ persistence endpoints by stack-counting them across the fleet to find outliers.", "expected_signal": "Documented login/logout paths seen on only one or two appliances, indicating custom Nginx rewrites for webshell access." }, "parents": [ { "id": "exploitation-analysis" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare API path persistence", "reads": [ "url_path", "device_hostname", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT url_path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_http_activity WHERE url_path LIKE '/__api__/%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY url_path HAVING host_count < 3 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Documented login/logout paths seen on only one or two appliances, indicating custom Nginx rewrites for webshell access.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "url_path" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "fingerprint-search", "type": "query", "label": "Adversary browser fingerprint search", "config": { "dsl": "sqlite", "role": "triage", "source": "web", "content": "SELECT device_hostname, src_endpoint_ip, url_full, time FROM hb_http_activity WHERE user_agent = '{{malicious_ua}}' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Locate the specific User-Agent associated with UTA0533 lateral movement across all web traffic.", "expected_signal": "Any traffic carrying the hardcoded UA, particularly originating from an appliance or targeting internal web resources." }, "parents": [ { "id": "exploitation-analysis" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Adversary browser fingerprint search", "reads": [ "device_hostname", "src_endpoint_ip", "url_full", "time", "user_agent" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, src_endpoint_ip, url_full, time FROM hb_http_activity WHERE user_agent = '{{malicious_ua}}' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Any traffic carrying the hardcoded UA, particularly originating from an appliance or targeting internal web resources.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "lateral-movement-auth", "type": "query", "label": "Lateral movement from appliance IPs", "config": { "dsl": "sqlite", "role": "triage", "source": "identity", "content": "SELECT src_endpoint_ip, dst_endpoint_name, actor_user_name, status, time FROM hb_auth_signin WHERE instr(',' || '{{appliance_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 AND NOT (instr(',' || '{{service_accounts}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Identify anomalous sign-ins originating from VPN appliances while filtering out legitimate service account noise.", "expected_signal": "Authentication attempts to internal servers originating from the appliance IPs that do not match known synchronization service accounts." }, "parents": [ { "id": "exploitation-analysis" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Lateral movement from appliance IPs", "reads": [ "src_endpoint_ip", "dst_endpoint_name", "actor_user_name", "status", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT src_endpoint_ip, dst_endpoint_name, actor_user_name, status, time FROM hb_auth_signin WHERE instr(',' || '{{appliance_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 AND NOT (instr(',' || '{{service_accounts}}' || ',', ',' || LOWER(actor_user_name) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Authentication attempts to internal servers originating from the appliance IPs that do not match known synchronization service accounts.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "intrusion-depth-analysis", "type": "analytic", "label": "Analyze intrusion depth", "config": { "cite": "required", "tools": [ "endpoint", "identity", "web" ], "context": [ "exploitation-analysis", "webshell-prevalence-search", "fingerprint-search", "lateral-movement-auth" ], "objective": "Determine if the adversary progressed from initial appliance exploitation to establishing persistence via rare API endpoints and performing lateral authentication.", "description": "Synthesize the early exploitation evidence with the persistence and movement findings to determine the severity of the intrusion.", "max_iterations": 4, "expected_signal": "A comprehensive verdict linking initial access to persistent presence.", "success_criteria": "A final verdict of malicious per host, citing the relationship between the bypass, the database shell execution, and the follow-on lateral indicators." }, "parents": [ { "id": "webshell-prevalence-search", "kind": "merge" }, { "id": "fingerprint-search", "kind": "merge" }, { "id": "lateral-movement-auth", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on intrusion verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "The intrusion-depth-analysis verdict is malicious for at least one appliance host.", "condition": "The intrusion-depth-analysis verdict is malicious for at least one appliance host.", "blind_spot": "limited-edge-telemetry", "confidence": "high", "description": "Direct the workflow based on the agent verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "intrusion-depth-analysis" } ] }, { "id": "isolate-appliance", "type": "action", "label": "Isolate compromised appliance", "config": { "target": "endpoint", "description": "Sever the adversary beachhead and prevent further internal movement.", "instructions": "Isolate the compromised SonicWall appliance from the network. Revoke all administrative and service account credentials found within the appliance configuration, particularly LDAP/AD synchronization accounts.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "remediation-verification", "type": "task", "label": "Forensic and remediation verification", "config": { "assignee": "analyst", "description": "Verify the removal of webshells and implementation of the hotfix.", "instructions": "Audit the Nginx configuration for unauthorized rewrite rules mapping to /__api__/. Confirm the deletion of /usr/lib/python3.11/site-packages/deploy_new.py. Verify that firmware version 12.4.3-03453 or 12.5.0-02835 is installed across all SMA appliances." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-appliance" } ] }, { "id": "hunt-close-out", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Record findings and finalize the hunt process.", "instructions": "Document all observed indicators and compromised hosts. If evidence of lateral movement was found, escalate to the IR team for full internal investigation of the targeted directory services." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "remediation-verification" } ] } ] }