Zimbra Swatchdog SNMP Command Injection Execution

[rule]
description = """
Detects a Unix shell launched by Perl from a generated Zimbra .swatchdog_script when the shell command line contains an
snmptrap invocation and the Zimbra zmServiceName and zmServiceStatus varbinds, followed by a child process other than
the Zimbra snmptrap binary. This behavior is consistent with command execution through CVE-2026-73570.
"""
id = "f18f2500-70f4-4d14-b2f2-2a3b15d54593"
license = "Elastic License v2"
name = "Zimbra Swatchdog SNMP Command Injection Execution"
os_list = ["linux"]
reference = [
    "https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/",
    "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search=CVE-2026-73570",
]
version = "1.0.1"

query = '''
sequence with maxspan=30s
  [process where event.type == "start" and event.action == "exec" and
    process.name in ("sh", "bash", "dash", "ash", "zsh", "ksh") and
    process.parent.name like "perl*" and
    process.parent.command_line like~ "*.swatchdog_script*" and
    process.command_line like~ "*snmptrap*" and
    process.command_line like~ "*zmservicename*" and
    process.command_line like~ ("*zmservicestatus *", "*zmservicestatus;*")
  ] by process.entity_id
  [process where event.type == "start" and event.action == "exec" and
    not process.executable like "/opt/zimbra/*/bin/snmptrap"
  ] by process.parent.entity_id
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"


[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"