{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Zimbra servers contain the organization's entire communication history and authentication secrets; confirmed post-exploitation activity here represents a total data breach scenario requiring immediate response." }, "name": "Zimbra Post-Exploitation and Cluster Exfiltration", "type": "investigation", "labels": [ "hunt", "attack.t1552.004", "attack.t1003", "attack.t1021.004", "attack.t1105", "attack.t1071.001", "attack.t1564.010", "attack.t1041", "attack.t1560", "command and control", "credential access", "discovery", "exfiltration", "initial access", "lateral movement", "persistence", "privilege escalation" ], "series": { "slug": "unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570", "index": 3, "title": "Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570", "total": 3 }, "related": [ { "hunt": "zimbra-unauth-rce-initial-access", "reason": "This hunt focuses on the post-exploitation phase after the initial RCE exploit.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule on zmlocalconfig may be too noisy or easily bypassed by grepping localconfig.xml directly; this hunt correlates harvesting, cluster-wide SSH movement, and anomalous Go binary execution into a single high-confidence verdict.", "coverage": [ { "stage": "zimbra-credential-harvesting", "steps": [ "credential-harvesting" ], "status": "covered" }, { "stage": "lateral-movement-via-ssh", "steps": [ "cluster-lateral-movement" ], "status": "covered" }, { "stage": "multi-stage-go-implant-c2", "steps": [ "follow-on-implants" ], "status": "covered" }, { "stage": "mailbox-and-auth-exfiltration", "steps": [ "exfiltration-staging" ], "status": "covered" }, { "stage": "unauthenticated-rce-snmp-path", "reason": "Belongs to another part of the 'Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570' series.", "status": "out_of_scope" }, { "stage": "webshell-deployment-and-reconstruction", "reason": "Belongs to another part of the 'Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570' series.", "status": "out_of_scope" }, { "stage": "zimbra-environment-reconnaissance", "reason": "Belongs to another part of the 'Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570' series.", "status": "out_of_scope" }, { "stage": "pam-abuse-privilege-escalation", "reason": "Belongs to another part of the 'Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570' series.", "status": "out_of_scope" }, { "stage": "systemd-service-persistence", "reason": "Belongs to another part of the 'Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Unauthenticated RCE via SNMP path", "slug": "unauthenticated-rce-snmp-path", "tactic": "initial-access", "techniques": [ "T1190", "T1059.004" ], "observables": [ "CVE-2026-73570", "swatchdog", "snmptrap", "ZB73570 User-Agent", "oast.fun", "oast.online", "dnslog.pp.ua", "requestrepo.com", "bypass.eu.org" ] }, { "name": "Webshell deployment and reconstruction", "slug": "webshell-deployment-and-reconstruction", "tactic": "persistence", "techniques": [ "T1505.003", "T1027" ], "observables": [ "JSP webshells in Jetty application paths", "JSP webshells in mailboxd application paths", "Payload reconstruction from staged fragments", "webroot permission modification" ] }, { "name": "Zimbra environment reconnaissance", "slug": "zimbra-environment-reconnaissance", "tactic": "discovery", "techniques": [ "T1082", "T1087" ], "observables": [ "zmprov to map mailbox nodes", "zmprov to map MTA nodes", "Checking /opt/zimbra/.ssh/zimbra_identity" ] }, { "name": "PAM abuse privilege escalation", "slug": "pam-abuse-privilege-escalation", "tactic": "privilege-escalation", "techniques": [ "T1548.003", "T1556" ], "observables": [ "Symlink zmmailboxd.out -> /etc/pam.d/sudo", "zmmailboxdmgr invocation", "pam_exec session hook", "zmstat-fd invocation", "NOPASSWD: ALL added to sudoers" ] }, { "name": "Systemd service persistence", "slug": "systemd-service-persistence", "tactic": "persistence", "techniques": [ "T1543.002", "T1070.006" ], "observables": [ "/etc/systemd/system/zimlog.service", "timestomping to match rsync.service", "timestomping to match sshd.service", "systemctl enable zimlog.service" ] }, { "name": "Zimbra credential harvesting", "slug": "zimbra-credential-harvesting", "tactic": "credential-access", "techniques": [ "T1552.004", "T1003" ], "observables": [ "zmlocalconfig -s", "ldapsearch for zimbraPreAuthKey", "ldapsearch for zimbraAuthTokenKey", "ldapsearch for zimbraTwoFactorAuthSecret" ] }, { "name": "Lateral movement via SSH", "slug": "lateral-movement-via-ssh", "tactic": "lateral-movement", "techniques": [ "T1021.004" ], "observables": [ "ssh -i /opt/zimbra/.ssh/zimbra_identity", "StrictHostKeyChecking=no", "rsync to peer mailbox nodes" ] }, { "name": "Multi-stage Go implant C2", "slug": "multi-stage-go-implant-c2", "tactic": "command-and-control", "techniques": [ "T1105", "T1071.001", "T1564.010" ], "observables": [ "agent2.sh downloader", "zimdown2 installer", "zimclient2 agent", "named pipe /tmp/s", "openssl s_client to remote endpoint", "memfd_create execution" ] }, { "name": "Mailbox and auth exfiltration", "slug": "mailbox-and-auth-exfiltration", "tactic": "exfiltration", "techniques": [ "T1041", "T1560" ], "observables": [ "zimbra-exfil/client-dump module", "hidden archive creation for exfiltration" ] } ], "summary": "An unauthenticated RCE campaign exploiting CVE-2026-73570 in Zimbra's SNMP notification path to execute commands as the zimbra user. Attackers deployed JSP webshells, escalated to root by abusing pam_exec and sudo helpers, and utilized custom Go-based agents to exfiltrate service authentication keys and mailbox data." }, "severity": "high", "rationale": "Start with servers running Zimbra (Mailbox nodes, MTAs). Use the identified hosts to populate the scope_hosts parameter for subsequent steps.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An attacker who has compromised a Zimbra server is harvesting service credentials and moving laterally to peer nodes using the Zimbra SSH identity to exfiltrate mailbox data via specialized Go implants.", "parameters": { "scope_hosts": { "from": { "ref": "hunt-config", "kind": "manual", "observed": "2026-09-30" }, "type": "list[host]", "default": [], "description": "Hostnames identified in the scoping step; leave empty to hunt the whole estate." }, "lookback_days": { "from": { "ref": "hunt-config", "kind": "manual", "observed": "2026-09-30" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/", "name": "Microsoft Security Blog: Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570" } ], "blind_spots": [ { "id": "missing-process-telemetry", "risk": "An attacker can move to an unmonitored node in the cluster and perform exfiltration there without being recorded.", "question": "whether commands ran on nodes without telemetry agents", "requires": "hb_process_activity on all mail cluster nodes" }, { "id": "encrypted-c2-content", "risk": "While the shell activity is visible as a process, the exact content of the commands and exfiltrated data remains hidden.", "stage": "multi-stage-go-implant-c2", "question": "the specific commands sent over the openssl s_client tunnel", "requires": "Network TLS decryption" } ] }, "name": "Zimbra Post-Exploitation and Cluster Exfiltration", "description": "This hunt focuses on the late-stage actions following the exploitation of CVE-2026-73570. It examines the harvest of high-value authentication keys from local configurations, the use of shared SSH identities to move laterally across the mail cluster, and the deployment of advanced Go-based agents. The hunt follows a phased approach: first identifying the mail cluster servers, then triaging early movement and credential theft, and finally searching for the complex implants and exfiltration staging files. By looking for anomalous execution within the Zimbra directory structure and openssl-backed encrypted shells, this hunt distinguishes targeted server compromise from generic scanning activity." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570", "index": 3, "title": "Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570", "total": 3 }, "coverage": [ { "stage": "zimbra-credential-harvesting", "steps": [ "credential-harvesting" ], "status": "covered" }, { "stage": "lateral-movement-via-ssh", "steps": [ "cluster-lateral-movement" ], "status": "covered" }, { "stage": "multi-stage-go-implant-c2", "steps": [ "follow-on-implants" ], "status": "covered" }, { "stage": "mailbox-and-auth-exfiltration", "steps": [ "exfiltration-staging" ], "status": "covered" }, { "stage": "unauthenticated-rce-snmp-path", "reason": "Belongs to another part of the 'Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570' series.", "status": "out_of_scope" }, { "stage": "webshell-deployment-and-reconstruction", "reason": "Belongs to another part of the 'Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570' series.", "status": "out_of_scope" }, { "stage": "zimbra-environment-reconnaissance", "reason": "Belongs to another part of the 'Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570' series.", "status": "out_of_scope" }, { "stage": "pam-abuse-privilege-escalation", "reason": "Belongs to another part of the 'Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570' series.", "status": "out_of_scope" }, { "stage": "systemd-service-persistence", "reason": "Belongs to another part of the 'Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570' series.", "status": "out_of_scope" } ], "rationale": "An attacker who has compromised a Zimbra server is harvesting service credentials and moving laterally to peer nodes using the Zimbra SSH identity to exfiltrate mailbox data via specialized Go implants.", "blind_spots": [ { "id": "missing-process-telemetry", "risk": "An attacker can move to an unmonitored node in the cluster and perform exfiltration there without being recorded.", "question": "whether commands ran on nodes without telemetry agents", "requires": "hb_process_activity on all mail cluster nodes" }, { "id": "encrypted-c2-content", "risk": "While the shell activity is visible as a process, the exact content of the commands and exfiltrated data remains hidden.", "stage": "multi-stage-go-implant-c2", "question": "the specific commands sent over the openssl s_client tunnel", "requires": "Network TLS decryption" } ], "scoping_notes": "Start with servers running Zimbra (Mailbox nodes, MTAs). Use the identified hosts to populate the scope_hosts parameter for subsequent steps.", "beyond_detection": "A single rule on zmlocalconfig may be too noisy or easily bypassed by grepping localconfig.xml directly; this hunt correlates harvesting, cluster-wide SSH movement, and anomalous Go binary execution into a single high-confidence verdict." } }, { "id": "identify-zimbra-hosts", "type": "query", "label": "Identify Zimbra Servers", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%zimbra%'", "surface": "hb_software_inventory", "description": "Identify the mail cluster by finding hosts with Zimbra software installed to narrow the hunt scope.", "expected_signal": "A list of hostnames belonging to the mail cluster. Silence means no Zimbra software is recorded in inventory." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify Zimbra Servers", "reads": [ "device_hostname", "package_name", "package_version" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%zimbra%'", "silence": "not_evidence_of_absence", "expected": "A list of hostnames belonging to the mail cluster. Silence means no Zimbra software is recorded in inventory.", "verified": "dry-run", "verified_at": "2026-10-20" } }, { "id": "credential-harvesting", "type": "query", "label": "Zimbra Credential Harvesting", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, user_name, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%zmlocalconfig -s%' OR LOWER(process_cmd_line) LIKE '%zimbrapreauthkey%' OR LOWER(process_cmd_line) LIKE '%zimbraauthtokenkey%' OR LOWER(process_cmd_line) LIKE '%zimbratwofactorauthsecret%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect usage of Zimbra tools or manual inspection of configuration files to dump service credentials.", "expected_signal": "Process command lines showing the zimbra user dumping global configuration or authentication secrets. Silence means no such commands were captured." }, "parents": [ { "id": "identify-zimbra-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Zimbra Credential Harvesting", "reads": [ "device_hostname", "user_name", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, user_name, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%zmlocalconfig -s%' OR LOWER(process_cmd_line) LIKE '%zimbrapreauthkey%' OR LOWER(process_cmd_line) LIKE '%zimbraauthtokenkey%' OR LOWER(process_cmd_line) LIKE '%zimbratwofactorauthsecret%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Process command lines showing the zimbra user dumping global configuration or authentication secrets. Silence means no such commands were captured.", "verified": "dry-run", "verified_at": "2026-10-20" } }, { "id": "cluster-lateral-movement", "type": "query", "label": "Cluster Lateral Movement", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT process_cmd_line, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%/opt/zimbra/.ssh/zimbra_identity%' OR LOWER(process_cmd_line) LIKE '%stricthostkeychecking=no%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_cmd_line HAVING host_count <= 2", "surface": "hb_process_activity", "description": "Identify lateral movement by searching for usage of the shared Zimbra SSH identity across the cluster.", "expected_signal": "SSH or rsync commands using the Zimbra identity file that appear on only one or two hosts. Silence means no rare cluster-wide SSH activity was seen." }, "parents": [ { "id": "identify-zimbra-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Cluster Lateral Movement", "reads": [ "process_cmd_line", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT process_cmd_line, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%/opt/zimbra/.ssh/zimbra_identity%' OR LOWER(process_cmd_line) LIKE '%stricthostkeychecking=no%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_cmd_line HAVING host_count <= 2", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "SSH or rsync commands using the Zimbra identity file that appear on only one or two hosts. Silence means no rare cluster-wide SSH activity was seen.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_cmd_line" ], "rare_below": 3 }, "verified_at": "2026-10-20" } }, { "id": "triage-early-evidence", "type": "analytic", "label": "Triage Early Evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "credential-harvesting", "cluster-lateral-movement" ], "objective": "Determine if the zmlocalconfig usage or SSH identity usage is consistent with an attacker moving between nodes or harvesting secrets.", "description": "Evaluate whether the observed credential dumping and cluster movement indicates a malicious actor.", "max_iterations": 3, "expected_signal": "A per-host verdict on early post-exploitation activity.", "success_criteria": "A verdict of malicious | suspicious | benign per host citing the command patterns." }, "parents": [ { "id": "credential-harvesting", "kind": "merge" }, { "id": "cluster-lateral-movement", "kind": "merge" } ] }, { "id": "follow-on-implants", "type": "query", "label": "Follow-on Implants", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, user_name, process_path, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_path) LIKE '/opt/zimbra/%' AND LOWER(process_path) NOT LIKE '/opt/zimbra/bin/%' AND LOWER(process_path) NOT LIKE '/opt/zimbra/libexec/%' AND LOWER(process_path) NOT LIKE '/opt/zimbra/common/%' OR (LOWER(process_cmd_line) LIKE '%openssl s_client%' AND LOWER(process_cmd_line) LIKE '%/tmp/s%') OR (LOWER(process_cmd_line) LIKE '%memfd_create%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect anomalous binary execution from within /opt/zimbra/ subdirectories and encrypted shells.", "expected_signal": "Processes running from non-standard Zimbra paths or openssl sessions used as reverse shells. Silence means no anomalous Zimbra-user execution was found." }, "parents": [ { "id": "triage-early-evidence" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Follow-on Implants", "reads": [ "device_hostname", "user_name", "process_path", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, user_name, process_path, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_path) LIKE '/opt/zimbra/%' AND LOWER(process_path) NOT LIKE '/opt/zimbra/bin/%' AND LOWER(process_path) NOT LIKE '/opt/zimbra/libexec/%' AND LOWER(process_path) NOT LIKE '/opt/zimbra/common/%' OR (LOWER(process_cmd_line) LIKE '%openssl s_client%' AND LOWER(process_cmd_line) LIKE '%/tmp/s%') OR (LOWER(process_cmd_line) LIKE '%memfd_create%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Processes running from non-standard Zimbra paths or openssl sessions used as reverse shells. Silence means no anomalous Zimbra-user execution was found.", "verified": "dry-run", "verified_at": "2026-10-20" } }, { "id": "exfiltration-staging", "type": "query", "label": "Exfiltration Staging", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, actor_user_name, file_path, file_name, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%/tmp/.%' OR LOWER(file_name) LIKE '%.tar.gz' OR LOWER(file_name) LIKE '%.zip' OR LOWER(file_name) LIKE '%.7z') AND (LOWER(process_name) LIKE '%zimbra%' OR LOWER(actor_user_name) = 'zimbra') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Search for the creation of hidden archives or temporary data fragments by the Zimbra process.", "expected_signal": "Creation of archives in /tmp or hidden directories by Zimbra-associated processes. Silence means no suspicious file staging was seen." }, "parents": [ { "id": "triage-early-evidence" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Exfiltration Staging", "reads": [ "device_hostname", "actor_user_name", "file_path", "file_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, actor_user_name, file_path, file_name, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%/tmp/.%' OR LOWER(file_name) LIKE '%.tar.gz' OR LOWER(file_name) LIKE '%.zip' OR LOWER(file_name) LIKE '%.7z') AND (LOWER(process_name) LIKE '%zimbra%' OR LOWER(actor_user_name) = 'zimbra') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Creation of archives in /tmp or hidden directories by Zimbra-associated processes. Silence means no suspicious file staging was seen.", "verified": "dry-run", "verified_at": "2026-10-20" } }, { "id": "triage-final-intrusion", "type": "analytic", "label": "Final Intrusion Triage", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "triage-early-evidence", "follow-on-implants", "exfiltration-staging" ], "objective": "Weigh the Phase 1 movement and harvest against the Phase 2 agents and staging activity to confirm a completed mailbox exfiltration operation.", "description": "Correlate early harvesting with the deployment of follow-on agents and staging.", "max_iterations": 5, "expected_signal": "A final verdict on whether a full intrusion and data exfiltration occurred.", "success_criteria": "A final verdict citing the linkage between initial harvest and follow-on agent deployment." }, "parents": [ { "id": "follow-on-implants", "kind": "merge" }, { "id": "exfiltration-staging", "kind": "merge" } ] }, { "id": "decision-route", "type": "checkpoint", "label": "Route on Intrusion Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-final-intrusion verdict is malicious for at least one host", "condition": "the triage-final-intrusion verdict is malicious for at least one host", "blind_spot": "missing-process-telemetry", "confidence": "high", "description": "Determine the response path based on the confirmed presence of malicious activity.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-final-intrusion" } ] }, { "id": "isolate-compromised-node", "type": "action", "label": "Isolate Compromised Node", "config": { "target": "endpoint", "description": "Immediately contain the mail server before further exfiltration.", "instructions": "Isolate the host from the network. Revoke the Zimbra SSH identity across the entire cluster and rotate all LDAP, Postfix, and service account credentials immediately.", "action_approval": "required" }, "parents": [ { "id": "decision-route", "branch": "on_supports" } ] }, { "id": "analyst-forensic-review", "type": "task", "label": "Analyst Forensic Review", "config": { "assignee": "analyst", "description": "Perform manual analysis of anomalous binaries and cluster-wide movement.", "instructions": "Examine the /opt/zimbra/ directory for binaries running as the zimbra user that do not belong to the standard install. Verify the other hosts in the mail cluster for the presence of the same SSH identity usage or hidden archive files." }, "parents": [ { "id": "decision-route", "branch": "default" }, { "id": "decision-route", "branch": "on_unavailable" }, { "id": "isolate-compromised-node" } ] }, { "id": "close-out-negative", "type": "task", "label": "Close Out Negative", "config": { "assignee": "analyst", "description": "Document the absence of post-exploitation markers in the cluster.", "instructions": "Record that no evidence of Zimbra credential harvesting or follow-on implant activity was found. Recommend verifying that the zimbra-snmp package is either updated or disabled." }, "parents": [ { "id": "decision-route", "branch": "on_refutes" } ] } ] }