Threat hunts for Web Server
26 hunts covering Web Server, each with a hypothesis, the queries that test it and what the hunt cannot see.
26 hunts
-
high Part 2 of 2Research by Rapid7
BPFDoor and AVERAT Passive Network Tunneling
An adversary has deployed a passive BPF-based backdoor that remains dormant until triggered by specially crafted SMTP or HTTPS traffic, allowing for protocol tunneling without maintaining an open listening port.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · defense evasion · execution -
high Part 1 of 2Research by Rapid7
Resident Watchdog and Masquerading on Linux Edge
An intruder has installed persistence on a Linux appliance by using a shell script to stage binaries in /sbin, then deleting the files to leave the processes running as fileless masqueraded daemons.
5 query2 analytic1 checkpoint1 action2 taskcommand and control · defense evasion · execution -
high Part 2 of 2Research by Huntress
Web Worker Discovery and Payment Data Harvesting
An intruder is using a compromised IIS web worker to execute discovery tools and search for payment card data or database credentials.
3 query2 analytic2 checkpoint1 action2 taskcollection · discovery · execution -
high Part 1 of 2Research by Huntress
Web Shell Ingress and Platform Probing
An intruder has exploited a file upload vulnerability to drop web shells in member-facing directories after probing the application boundary and brute-forcing credentials.
3 query1 analytic1 checkpoint1 action2 taskcollection · discovery · execution -
high Part 3 of 3Research by Microsoft
Zimbra secrets theft and cluster propagation
An intruder is using Zimbra administrative utilities to dump service credentials and move laterally to peer nodes using the zimbra service account's SSH identity.
5 query2 analytic1 checkpoint1 action2 taskCVE-2026-73570 -
high Part 2 of 3Research by Microsoft
Zimbra Privilege Escalation and Root Persistence
An intruder has escalated from the Zimbra service account to root by symlinking application logs to PAM configurations and established persistence through a rare systemd service.
3 query1 analytic1 checkpoint1 action2 taskCVE-2026-73570 -
high Part 1 of 3Research by Microsoft
Zimbra CVE-2026-73570 RCE and JSP Web Shell Entry
An attacker is exploiting CVE-2026-73570 on internet-facing Zimbra servers to execute commands via the SNMP path and drop JSP web shells in the webroot for persistence.
4 query2 analytic2 checkpoint1 action2 taskCVE-2026-73570 -
highResearch by Rapid7
Unauthenticated N-central Administrator Account Creation
An intruder has exploited a routing discrepancy between Envoy and Jetty in an N-central server to bypass authentication and create a new administrative account for persistence.
3 query2 analytic2 checkpoint1 action2 taskCVE-2026-18577 · CVE-2026-86206 -
highResearch by Rapid7
Metasploit Framework Exploitation and Post-Exploitation
An intruder has leveraged one of sixteen new Metasploit modules to exploit a public-facing web application and establish persistence or conduct Kerberos authentication relaying.
5 query2 analytic1 checkpoint1 action2 taskCVE-2025-54988 · CVE-2025-66516 -
highResearch by Rapid7
PaperCut NG/MF Auth Bypass to RCE and Ransomware
An attacker has exploited the PaperCut NG/MF authentication bypass vulnerabilities to reconfigure external database lookups and execute arbitrary code, leading to log tampering or ransomware deployment.
5 query2 analytic1 checkpoint1 action2 taskCVE-2023-27350 · CVE-2026-81578 -
high Part 2 of 2Research by Rapid7
DPRK CurlRAT and HAProxy Ted Interception
An adversary has compromised the edge load balancer by installing a custom HAProxy filter and a Curl-based RAT to intercept web traffic and execute remote commands.
4 query1 analytic1 checkpoint1 action2 taskcollection · command and control · credential access -
high Part 1 of 2Research by Rapid7
Linux System Daemon Trojanization and Credential Harvesting
An adversary has established long-term persistence and credential harvesting by replacing legitimate Linux system daemons with trojanized versions that log passwords and monitor process health.
3 query2 analytic2 checkpoint1 action2 taskcollection · command and control · credential access -
high Part 2 of 2Research by Huntress
On-Host Miner Compilation and Resource Hijacking
An adversary has compiled a custom Monero miner directly on an endpoint using .NET and C compilers before executing it as a system process to hijack compute resources.
3 query1 analytic1 checkpoint1 action2 taskdefense evasion · execution · impact -
high Part 3 of 3Research by The DFIR Report
Apache ActiveMQ Lateral Movement and Ransomware Impact
An attacker has transitioned from an exploited ActiveMQ server to lateral movement via RDP using stolen credentials, ultimately deploying LockBit ransomware from user-writable directories or with specific execution flags.
3 query1 analytic1 checkpoint1 action2 taskCVE-2023-46604 -
high Part 1 of 3Research by The DFIR Report
ActiveMQ Exploitation and Metasploit Staging
An intruder has exploited CVE-2023-46604 on an ActiveMQ server to run arbitrary code, staged a Metasploit payload, and escalated to SYSTEM privileges using named pipe impersonation.
4 query2 analytic1 checkpoint1 action2 taskCVE-2023-46604 -
criticalResearch by Volexity
SonicWall Appliance Zero-Day Exploitation and Webshells
An adversary has exploited a pre-authentication proxy bypass and CVE-2026-15410 to execute commands on a SonicWall SMA appliance, established persistence via Nginx rewrites, and moved laterally using specific browser fingerprints.
6 query2 analytic1 checkpoint1 action2 taskCVE-2026-15410 -
high Part 2 of 2Research by Cisco Talos
VoidLink Lateral Scanning and Mesh C2
An intruder is using a VoidLink implant to perform automated internal reconnaissance and establish a peer-to-peer mesh command-and-control network between compromised Linux servers.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · discovery · execution -
high Part 1 of 2Research by Cisco Talos
VoidLink: Exploitation and Kernel-Level Implant Deployment
An adversary has exploited a Java-based Apache Dubbo service to deploy a ZigLang-based VoidLink implant and maintained stealth using an unsigned kernel-level rootkit.
3 query2 analytic2 checkpoint1 action2 taskcommand and control · discovery · execution -
high Part 2 of 2Research by Volexity
VerdantBamboo Stolen Credential and Pivot Hunt
An adversary has used stolen administrative or service account credentials to access edge appliances via VPN or SSH, subsequently using web-based management interfaces to pivot further or deploy persistence.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · execution · initial access -
high Part 1 of 2Research by Volexity
VERDANTBAMBOO Edge Appliance Post-Exploitation
An adversary compromises an edge appliance, uses an inadvertent sudo configuration to escalate to root, and creates persistence via cron to tunnel traffic through DNS-over-HTTPS.
5 query2 analytic1 checkpoint1 action2 taskcommand and control · execution · initial access -
critical Part 2 of 2Research by Mandiant
UNC6201 Network Evasion and C2
An adversary is using iptables REDIRECT rules for Single Packet Authorization and DNS-over-HTTPS for command-and-control to hide ingress traffic and outbound beacons on compromised appliances.
3 query1 analytic1 checkpoint1 action2 taskCVE-2026-22769 -
critical Part 1 of 2Research by Mandiant
Dell RecoverPoint Appliance Intrusion and Persistence
An adversary is exploiting hardcoded credentials (CVE-2026-22769) to deploy SLAYSTYLE web shells and persistent GRIMBOLT backdoors on Dell RecoverPoint for Virtual Machines appliances.
3 query2 analytic2 checkpoint1 action2 taskCVE-2026-22769 -
high Part 2 of 3Research by Cisco Talos
UAT-10147: Host Elevation and Evasion
An adversary is executing automated staging scripts to deploy privilege escalation tools and blind security software on compromised web servers.
5 query2 analytic1 checkpoint1 action2 taskcommand and control · defense evasion · discovery -
high Part 1 of 3Research by Cisco Talos
Web Exploit and Telemetry Theft (UAT-10147)
The adversary exploits known web vulnerabilities in Zimbra, Telerik, or AjaxPro to achieve initial access and exfiltrates system identifiers to a Nacos configuration server via HTTP POST requests.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · defense evasion · discovery -
high Part 2 of 2Research by Elastic Security Labs
Web Server Shell Execution and wp2shell Post-Exploitation
An attacker has exploited a WordPress vulnerability to spawn a shell from a web server process and is currently performing system discovery or cleaning up traces of the wp2shell plugin.
3 query2 analytic2 checkpoint1 action2 taskCVE-2026-60137 · CVE-2026-63030 -
high Part 1 of 2Research by Elastic Security Labs
WordPress REST API Exploitation and Plugin Staging
An attacker is exploiting the wp2shell WordPress Core RCE chain to upload and stage a malicious plugin by abusing the unauthenticated REST batch API.
3 query1 analytic1 checkpoint1 action2 taskCVE-2026-60137 · CVE-2026-63030