Threat video1:00
PHP2Shell and Zammad Zero-Day Chain: Detection & IOCs
PHP2Shell was exploited during its embargo, and an AI agent chained Zammad zero-days at DIVD. 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for PHP2Shell and Zammad Zero-Day Chain: Detection & IOCs →
Chapters
- 0:00The hookAttempts came about 4 days before patches.
- 0:04The storyAn attacker chained Zammad zero-days.
- 0:11Attack pathReported probes came before patches, then leaked details.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise11 indicators to hunt: 9 IPs, 1 file name and 1 path.
- 0:38MITRE ATT&CK techniques11 ATT&CK techniques, from reconnaissance to command and control.
- 0:43Remediation5 steps now: Patch internet-facing PHP.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Attempts came about 4 days before patches.
0:05An attacker chained Zammad zero-days.
0:07DIVD detected it and cut access.
0:11Reported probes came before patches, then leaked details.
0:15Mass scanning followed, then memory-corruption flaws.
0:18Most public proofs did not achieve RCE.
0:21Karimi confirmed RCE on honeypots.
0:27No threat actor is attributed. Confidence: low.
0:3211 indicators to hunt: 9 IPs, 1 file name and 1 path.
0:3811 ATT&CK techniques, from reconnaissance to command and control.
0:435 steps now: Patch internet-facing PHP.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.