Zimbra Collaboration Suite (ZCS) OS Command Injection (CVE-2026-73570)

let zimbraParents = dynamic(["zmmailboxdmgr","java","zmconfigd","httpd","nginx","snmpd","zmstat","zmslapd","postfix","amavisd"]);
let suspiciousChildren = dynamic(["sh","bash","dash","curl","wget","nc","ncat","python","python3","perl","whoami","id","uname","chmod","base64"]);
DeviceProcessEvents
| where InitiatingProcessFileName has_any (zimbraParents) or InitiatingProcessAccountName == "zimbra"
| where FileName in~ (suspiciousChildren)
| where ProcessCommandLine has_any (";", "|", "&&", "$(", "`", "||", "-c") or FileName in~ ("nc","ncat","curl","wget")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

index=linux (sourcetype=linux:audit OR sourcetype=sysmon:linux OR sourcetype=osquery:results)
| where (like(parent_process,"%zmmailboxdmgr%") OR like(parent_process,"%zmconfigd%") OR like(parent_process,"%snmpd%") OR user="zimbra")
| where (like(process,"%/sh%") OR like(process,"%bash%") OR like(process,"%curl%") OR like(process,"%wget%") OR like(process,"%nc %") OR like(process,"%python%"))
| regex process_exec="[;|`]|\$\(|&&|\|\|"
| table _time, host, user, parent_process, process, process_exec
| sort - _time

process where event.type == "start" and
  (process.parent.name in ("zmmailboxdmgr","java","zmconfigd","snmpd","nginx","httpd") or user.name == "zimbra") and
  process.name in ("sh","bash","dash","curl","wget","nc","ncat","python","python3","perl","whoami","id") and
  process.command_line regex~ ".*([;|`]|\\$\\(|&&|\\|\\|).*"

SELECT QIDNAME(qid) AS event, sourceip, destinationip, username, "Process Name" AS process, "Parent Process Name" AS parent, "Process CommandLine" AS cmd FROM events WHERE ("Parent Process Name" ILIKE '%zmmailboxdmgr%' OR "Parent Process Name" ILIKE '%zmconfigd%' OR "Parent Process Name" ILIKE '%snmpd%' OR username = 'zimbra') AND ("Process Name" ILIKE '%sh' OR "Process Name" ILIKE '%curl%' OR "Process Name" ILIKE '%wget%' OR "Process Name" ILIKE '%nc') AND (cmd MATCHES '.*([;|`]|\$\(|&&).*') ORDER BY startTime DESC LAST 24 HOURS

_sourceCategory=*linux* ("zmmailboxdmgr" OR "zmconfigd" OR "snmpd" OR "zimbra")
| parse "user=* " as user nodrop
| parse "parent=* " as parent nodrop
| parse "cmd=*\"" as cmd nodrop
| where (parent matches "*zmmailboxdmgr*" or parent matches "*zmconfigd*" or parent matches "*snmpd*" or user = "zimbra")
| where cmd matches /(;|\||`|\$\(|&&)/ and (cmd matches "*sh *" or cmd matches "*curl*" or cmd matches "*wget*" or cmd matches "*nc *")
| count by user, parent, cmd
| sort by _count desc

rule zimbra_cve_2026_73570_cmd_injection {
  meta:
    author = "argus"
    description = "Zimbra ZCS OS command injection CVE-2026-73570"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (re.regex($e.principal.process.parent_process.file.full_path, `(zmmailboxdmgr|zmconfigd|snmpd)`) or $e.principal.user.userid = "zimbra")
    re.regex($e.target.process.file.full_path, `/(sh|bash|dash|curl|wget|nc|ncat|python|perl)$`)
    re.regex($e.target.process.command_line, `([;|` + "`" + `]|\$\(|&&|\|\|)`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2 event_platform=Lin
| ParentBaseFileName=/zmmailboxdmgr|zmconfigd|snmpd/ OR UserName=zimbra
| FileName=/^(sh|bash|dash|curl|wget|nc|ncat|python|python3|perl|whoami|id)$/
| CommandLine=/([;|`]|\$\(|&&|\|\|)/
| table([timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])