Threat video1:00
CVE-2000-0411 mailtest.php Spam Relay: Detection & IOCs
Scanners probe leftover mailtest.php scripts that relay spam. Track it with 9 detection rules, 10 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2000-0411 mailtest.php Spam Relay: Detection & IOCs →
Chapters
- 0:00The hook26-year-old mail tools hunted again.
- 0:04The storyThey're from twenty-six years back.
- 0:10Attack pathProbe for mail test scripts, identify software, relay spam through recipient parameter.
- 0:22AttributionNo threat actor is attributed.
- 0:27Indicators of compromise9 indicators to hunt: 8 URLs and 1 file name.
- 0:32MITRE ATT&CK techniques7 ATT&CK techniques, from reconnaissance to discovery.
- 0:37Remediation3 steps now: Search web roots for sendmail.php, test-mail.php, testemail.php, mail_config.php, email-test.php, mailtest.php.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0026-year-old mail tools hunted again.
0:05They're from twenty-six years back.
0:07Scanners hunt them now.
0:11Probe for mail test scripts, identify software, relay spam through recipient parameter.
0:23No threat actor is attributed. Confidence: low.
0:279 indicators to hunt: 8 URLs and 1 file name.
0:337 ATT&CK techniques, from reconnaissance to discovery.
0:373 steps now: Search web roots for sendmail.php, test-mail.php, testemail.php, mail_config.php, email-test.php, mailtest.php.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.