{
  "Event": {
    "uuid": "063ce33f-b7aa-5660-a9ff-f188850a7d87",
    "info": "Gotenberg CVE-2026-42589 Mass Exploitation and Cryptomining",
    "date": "2026-09-16",
    "threat_level_id": 1,
    "analysis": 2,
    "timestamp": 1791692758,
    "publish_timestamp": 1791692758,
    "published": true,
    "Orgc": {
      "name": "The Hunters Ledger",
      "uuid": "8bc8284b-deb5-546c-a233-57ea34b2ea0d"
    },
    "Tag": [
      {
        "name": "tlp:clear",
        "colour": "#ffffff"
      },
      {
        "name": "hunters-ledger:topic=\"Cryptojacking\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Mass Exploitation\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"CVE-2026-42589\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"XMRig\"",
        "colour": "#58a6ff"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Systemd Service - T1543.002\"",
        "colour": "#0088cc"
      }
    ],
    "Attribute": [
      {
        "uuid": "2433b525-10d1-5a82-9365-38f5fedd7e17",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/",
        "to_ids": false,
        "comment": "Detection rules, The Hunters Ledger",
        "timestamp": 1791692758
      },
      {
        "uuid": "5f114962-1202-5f67-88f8-3e59896a2ab9",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/ioc-feeds/gotenberg-rce-cryptomining-107-175-69-137-iocs.json",
        "to_ids": false,
        "comment": "IOC feed (JSON), The Hunters Ledger",
        "timestamp": 1791692758
      },
      {
        "uuid": "f5fe12b4-7b82-59b5-ac3d-f9329d83fbb7",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/reports/gotenberg-rce-cryptomining-107-175-69-137/",
        "to_ids": false,
        "comment": "Report, The Hunters Ledger",
        "timestamp": 1791692758
      },
      {
        "uuid": "1ac44357-bbdd-5bd5-81c3-eb1a8e09ec75",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/stix/gotenberg-rce-cryptomining-107-175-69-137.json",
        "to_ids": false,
        "comment": "STIX 2.1 bundle, The Hunters Ledger",
        "timestamp": 1791692758
      },
      {
        "uuid": "22f6078a-156b-5ed9-8977-37ec5efa570b",
        "type": "vulnerability",
        "category": "External analysis",
        "value": "CVE-2026-40281",
        "to_ids": false,
        "comment": "Named in the report",
        "timestamp": 1791692758
      },
      {
        "uuid": "fa59c416-9ba3-512e-b185-05d82d9e5724",
        "type": "vulnerability",
        "category": "External analysis",
        "value": "CVE-2026-42589",
        "to_ids": false,
        "comment": "Named in the report",
        "timestamp": 1791692758
      },
      {
        "uuid": "aa8e69bb-2356-52f9-8dee-76751a46fb88",
        "type": "snort",
        "category": "Network activity",
        "value": "# LOAD-BEARING: the bytes |5c 6e| in the content match below appear twice ON PURPOSE. They are\n# the JSON-escaped form of the injected newlines. The metadata field travels as JSON, so the\n# newline leaves the socket as the two ASCII bytes backslash (0x5c) and n (0x6e). Gotenberg\n# un-escapes it only server-side, after any sensor has seen the packet. Do NOT \"correct\" these\n# bytes to a raw 0x0a newline or to a PCRE newline escape: a rule keyed on a raw newline parses\n# cleanly and NEVER fires on real traffic (confirmed against captured traffic).\nalert http any any -> any any (msg:\"THL DETECT Gotenberg-RCE ExifTool Metadata Key Injection Attempt (CVE-2026-42589 Exploitation Indicator)\"; flow:established,to_server; http.method; content:\"POST\"; http.uri; content:\"/forms/pdfengines/metadata/write\"; http.request_body; content:\"|5c 6e 2d 69 66 5c 6e 73 79 73 74 65 6d 28|\"; fast_pattern; reference:cve,2026-42589; reference:url,the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/; classtype:attempted-admin; sid:9302001; rev:2; metadata:author The_Hunters_Ledger, date 2026-09-16;)",
        "to_ids": true,
        "comment": "Gotenberg ExifTool Metadata Key Injection over HTTP (CVE-2026-42589) | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1190 | rule hash b66c5244 | https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/",
        "timestamp": 1791692758,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "f34913d5-1bb9-59bc-ba2a-8383e2163b3a",
        "type": "snort",
        "category": "Network activity",
        "value": "alert http $HOME_NET any -> any any (msg:\"THL HUNT Gotenberg-RCE Command Output Body Markers START END (OOB Command-Output Indicator)\"; flow:established,to_server; http.request_body; content:\"===START===\"; content:\"===END===\"; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/; classtype:command-and-control; sid:9302004; rev:2; metadata:author The_Hunters_Ledger, date 2026-09-16;)",
        "to_ids": false,
        "comment": "Out-of-Band Command Output Body Markers (START/END Brackets) | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1041 | rule hash 2bb604eb | https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/",
        "timestamp": 1791692758,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "1628add3-786b-5a54-bb22-e6bf950a31a7",
        "type": "snort",
        "category": "Network activity",
        "value": "alert http $HOME_NET any -> any any (msg:\"THL HUNT Gotenberg-RCE Miner Deploy Verdict Body MINER_OK (OOB Deploy-Callback Indicator)\"; flow:established,to_server; http.request_body; content:\"MINER_OK\"; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/; classtype:command-and-control; sid:9302003; rev:2; metadata:author The_Hunters_Ledger, date 2026-09-16;)",
        "to_ids": false,
        "comment": "Out-of-Band Deploy Verdict Body (MINER_OK) | TIER: Hunting | robustness 1 | confidence HIGH that a hit is this toolkit's deploy channel; the literal is the operator's own verdict token, written by their deploy script | ATT&CK T1071.001 | rule hash 6fd6621e | https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/",
        "timestamp": 1791692758,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "4a1d1070-030c-5f2a-9ed6-f91cf8c7bf25",
        "type": "snort",
        "category": "Network activity",
        "value": "alert http $HOME_NET any -> any any (msg:\"THL HUNT Gotenberg-RCE Tagged Out-of-Band Callback URI Shape (C2 Beacon Indicator)\"; flow:established,to_server; http.uri; content:\"_\"; pcre:\"/^\\/(?:[TWCN]\\d+|PPROBE\\d+)_[^\\/\\s]+_\\d+\\/?$/\"; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/; classtype:command-and-control; sid:9302002; rev:2; metadata:author The_Hunters_Ledger, date 2026-09-16;)",
        "to_ids": false,
        "comment": "Out-of-Band Tagged Callback URI Shape | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1071.001 | rule hash 5c11ebc5 | https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/",
        "timestamp": 1791692758,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "3baaeac5-42be-5e88-8d1c-4a5264961d49",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Base64 Decode Redirected to Tmp Followed by Bash Run of a Tmp Path in One Command Line\nid: a3dcd1d3-0c9f-4cd2-a6e7-bed5dd6bd3c1\nstatus: experimental\ndescription: >-\n    Detects a single shell command line in which a base64 -d redirect into /tmp comes\n    before a bash run of a /tmp path, the staging shape this campaign's deploy driver uses\n    to carry its miner install script through shell quoting constraints (echo of encoded\n    script piped to base64 -d into /tmp/d.sh, then bash of that file). The rule checks the\n    order of the two fragments and does not check that the file bash runs is the file the\n    decode wrote.\n    Cloud provisioning and installer tooling legitimately uses decode-then-execute patterns,\n    so this is a hunting anchor and triage hits against deployment context.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/\nauthor: The Hunters Ledger\ndate: 2026-09-16\nmodified: 2026-10-11\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1059.004\n    - attack.t1140\n    - stp.2\nlogsource:\n    category: process_creation\n    product: linux\n    definition: >-\n        Requires process-creation telemetry that captures full command lines on the victim\n        host: auditd execve rules, Sysmon for Linux, or an EDR agent.\ndetection:\n    selection:\n        CommandLine|contains: 'base64 -d*>/tmp/*bash /tmp/'\n    condition: selection\nfalsepositives:\n    - Provisioning, cloud-init or installer scripts that decode payloads to tmp and run them\n    - Authorized security tooling staging encoded scripts\nlevel: medium",
        "to_ids": false,
        "comment": "Base64 Decode Redirected to Tmp Followed by Bash Run of a Tmp Path in One Command Line | TIER: Hunting | robustness 1 | confidence HIGH that the shape matches the campaign's staging step; the anchor itself is generic staging behavior | ATT&CK T1059.004, T1140 | rule hash 7ce79ff7 | https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/",
        "timestamp": 1791692758,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "7b874f61-ebcf-5a6a-a913-b383e6e80226",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: ExifTool Invoked With Condition Option Executing Shell Commands\nid: 37d092d3-cc96-4864-aef2-0679d3be9088\nstatus: experimental\ndescription: >-\n    Detects ExifTool being invoked with its -if condition option whose argument calls the\n    Perl system() function, the argv-splitting shape of CVE-2026-42589 metadata-key injection\n    as it appears in process telemetry on the victim host once Gotenberg expands the metadata\n    JSON. No legitimate ExifTool condition needs to execute shell commands, and any command\n    the injected condition runs (timing probes, out-of-band callbacks, staged scripts) matches.\nreferences:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42589\n    - https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/\nauthor: The Hunters Ledger\ndate: 2026-09-16\ntags:\n    - attack.initial-access\n    - attack.execution\n    - attack.t1190\n    - attack.t1059.004\n    - stp.4\nlogsource:\n    category: process_creation\n    product: linux\n    definition: >-\n        Requires process-creation telemetry that captures full command lines on the victim\n        host: auditd execve rules, Sysmon for Linux, or an EDR agent. Without command-line\n        capture the -if and system( arguments are not visible and this rule cannot fire.\ndetection:\n    selection_img:\n        Image|endswith: 'exiftool'\n    selection_cond:\n        CommandLine|contains: '-if'\n    selection_exec:\n        CommandLine|contains: 'system('\n    condition: selection_img and selection_cond and selection_exec\nfalsepositives:\n    - >-\n        Bespoke tooling whose legitimate -if condition evaluates Perl code that calls\n        system(), which has no known legitimate purpose but cannot be fully excluded\n    - Authorized security testing or red-team exercises replaying the CVE-2026-42589 payload\nlevel: high",
        "to_ids": true,
        "comment": "ExifTool Invoked With Condition Option Executing Shell Commands | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1190, T1059.004 | rule hash 66578dae | https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/",
        "timestamp": 1791692758,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "7dbd9aab-0547-5b84-b25b-011b393f4064",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Gotenberg ExifTool Metadata Key CVE-2026-42589 Injection Attempt\nid: 5c6643c6-b8b6-415c-b5b1-e14ab21125f9\nstatus: experimental\ndescription: >-\n    Detects an HTTP POST to a Gotenberg ExifTool metadata-write endpoint whose metadata JSON\n    key carries the JSON-escaped newline sequence \\n-if\\nsystem( , the wire-confirmed\n    signature of CVE-2026-42589 ExifTool argv-splitting RCE. Requires a telemetry source that\n    captures the raw HTTP request body (a reverse proxy, WAF, or network sensor forwarding\n    body content); Gotenberg's own application log does not record the metadata payload on a\n    request that parses as valid JSON, so this rule cannot run on that log.\nreferences:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42589\n    - https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/\nauthor: The Hunters Ledger\ndate: 2026-09-16\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - stp.4\nlogsource:\n    category: webserver\n    definition: >-\n        Assumes a reverse proxy, WAF, or gateway in front of Gotenberg that logs the raw\n        request body, or a network sensor that forwards body content into a searchable field.\n        The payload anchor is a fieldless keyword selection that matches payload text in the\n        log message; the Sigma specification defines no native field for raw request-body\n        content in any supported logsource category, so the endpoint is identified by the\n        proxy/webserver fields and the payload by the free-text match.\ndetection:\n    selection_method:\n        cs-method: 'POST'\n    selection_uri:\n        cs-uri-stem|contains: '/forms/pdfengines/metadata/write'\n    injection_anchor: '\\n-if\\nsystem('\n    condition: selection_method and selection_uri and injection_anchor\nfalsepositives:\n    - Authorized security testing or red-team exercises sending the same proof-of-concept payload against a Gotenberg instance\n    - Unlikely otherwise, no legitimate metadata-write payload shape tested matched this anchor\nlevel: high",
        "to_ids": true,
        "comment": "Gotenberg ExifTool Metadata Key CVE-2026-42589 Injection Attempt | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1190 | rule hash 638dd805 | https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/",
        "timestamp": 1791692758,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "4e73278b-c1c9-5449-aefa-59555db17a5e",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Gotenberg Metadata-Write Endpoint Anomalous Latency (Possible CVE-2026-42589)\nid: 38daaffe-5d58-4edb-9549-4aec80f168ac\nstatus: experimental\ndescription: >-\n    Gotenberg's own structured access log never records the metadata payload on a request\n    that parses as valid JSON, so a sleep-based CVE-2026-42589 RCE attempt is visible in this\n    log only as a latency spike on an endpoint that is otherwise sub-second (measured clean\n    baseline roughly 250 to 650 milliseconds). False-positive risk is high: a genuinely slow\n    ExifTool write (large or malformed document, resource contention) matches identically.\n    Use only where the Detection-tier rule's body visibility is unavailable. Not for alerting.\nreferences:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42589\nauthor: The Hunters Ledger\ndate: 2026-09-16\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - stp.3\nlogsource:\n    category: application\n    product: gotenberg\n    definition: >-\n        Keys on Gotenberg's own structured HTTP access log fields (uri, method, status,\n        latency). The latency field is assumed to carry Go's time.Duration serialized in\n        nanoseconds, so the 2000000000 threshold is 2 seconds; verify the unit in your own\n        deployment before relying on the threshold.\ndetection:\n    selection:\n        uri: '/forms/pdfengines/metadata/write'\n        method: POST\n        status: 200\n        latency|gte: 2000000000\n    condition: selection\nfalsepositives:\n    - Genuinely slow ExifTool metadata writes under load or on large or malformed documents\nlevel: low",
        "to_ids": false,
        "comment": "Gotenberg Metadata-Write Endpoint Anomalous Latency (Possible CVE-2026-42589) | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1190 | rule hash f75631fb | https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/",
        "timestamp": 1791692758,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "7cc43832-fdcf-58ce-81b8-ca2f579d8c66",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Pkill Kill Sweep Against Rival Cryptominer Process Names\nid: 68d7470d-33e0-4bed-9078-dc6c31d96138\nstatus: experimental\ndescription: >-\n    Detects a pkill -9 -f kill sweep aimed at process names used by commodity Linux\n    cryptominers before a competing payload is installed. This campaign's deploy script runs\n    such a sweep (against xmrig, systemd-devd, kdevtmpfsi, kswapd0, khovr and others) as its\n    first act on every target, and rival-miner kills were confirmed in captured deploy\n    output. The sweep is displacement behavior shared by rival cryptojacking operators, so\n    the anchor indicates miner-versus-miner competition on a host rather than this operator\n    specifically. Not for alerting; triage hits against known miner presence.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/\nauthor: The Hunters Ledger\ndate: 2026-09-16\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - stp.2\nlogsource:\n    category: process_creation\n    product: linux\n    definition: >-\n        Requires process-creation telemetry that captures full command lines on the victim\n        host: auditd execve rules, Sysmon for Linux, or an EDR agent.\ndetection:\n    selection_pkill:\n        CommandLine|contains|all:\n            - 'pkill'\n            - '-9'\n            - '-f'\n    selection_miner_name:\n        CommandLine|contains:\n            - 'kdevtmpfsi'\n            - 'kswapd0'\n            - 'khovr'\n            - 'systemd-devd'\n            - 'xmrig'\n    condition: selection_pkill and selection_miner_name\nfalsepositives:\n    - Administrators cleaning up a confirmed miner infection by hand\n    - >-\n        Another cryptojacking operator's own displacement sweep on the same host, which is\n        the behavior this rule detects and is expected to fire on\nlevel: medium",
        "to_ids": false,
        "comment": "Pkill Kill Sweep Against Rival Cryptominer Process Names | TIER: Hunting | robustness 1 | confidence HIGH that the behavior is real and miner-related, LOW that any single hit is this operator | ATT&CK T1059.004 | rule hash 9f8d78f6 | https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/",
        "timestamp": 1791692758,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "d085df30-4bad-5ab7-92b0-f2f5453e3e44",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Polkitd Daemon Executed From a Non-Standard Directory\nid: c0678478-efcc-4d57-b733-6a4971058ff1\nstatus: experimental\ndescription: >-\n    Detects a process running from an executable named polkitd outside the legitimate Polkit\n    install locations. In this campaign the XMRig miner masquerades as polkitd from both drop\n    locations (/tmp/polkitd/ ephemeral and /usr/bin/polkitd.d/ persistent), and the deploy\n    script kills any existing process named polkitd before installing its own, so this anchor\n    also surfaces rival miners reusing the same mask name. Host-side detection of the\n    masquerade is load-bearing because the persistent systemd variant survives a reboot.\nreferences:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42589\n    - https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/\nauthor: The Hunters Ledger\ndate: 2026-09-16\ntags:\n    - attack.stealth\n    - attack.t1036.005\n    - stp.4\nlogsource:\n    category: process_creation\n    product: linux\n    definition: >-\n        Requires process-creation telemetry that captures the full executable path on the\n        victim host: auditd execve rules, Sysmon for Linux, or an EDR agent.\ndetection:\n    selection_daemon:\n        Image|endswith: '/polkitd'\n    filter_legit_paths:\n        Image|startswith:\n            - '/usr/lib/polkit-1/'\n            - '/usr/libexec/polkit-1/'\n    condition: selection_daemon and not filter_legit_paths\nfalsepositives:\n    - Custom Polkit builds deployed at non-standard prefixes (Nix store, container image layer paths)\n    - Authorized security tooling or tests that stage a binary named polkitd\nlevel: high",
        "to_ids": true,
        "comment": "Polkitd Daemon Executed From a Non-Standard Directory | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1036.005 | rule hash 678303e7 | https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/",
        "timestamp": 1791692758,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "d8e6fdb4-fee1-5ea9-af45-08d05143439b",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Shell Spawned by Systemd Executes Binary After Path Export and Directory Change\nid: 7ed14be2-a79d-45e3-acae-7617284f746f\nstatus: experimental\ndescription: >-\n    Detects the persistent-install launch shape observed in this campaign's shipped\n    systemd-polkitd.service unit: a shell command execution whose command line exports a\n    directory onto PATH, changes into it, and execs a binary, all in one invocation. This is\n    the wrapper the miner's persistent root unit uses (Restart=always, RestartSec=10s,\n    User=root), and it is the shape a reboot does not clear. The anchor keys on the launch\n    pattern, not on the masqueraded binary name, so a renamed miner running the same wrapper\n    still matches.\nreferences:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42589\n    - https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/\nauthor: The Hunters Ledger\ndate: 2026-09-16\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1543.002\n    - stp.4\nlogsource:\n    category: process_creation\n    product: linux\n    definition: >-\n        Requires process-creation telemetry that captures both the parent process and the\n        full command line for processes spawned by systemd, for example auditd execve rules\n        with parent tracking, Sysmon for Linux, or an EDR agent.\ndetection:\n    selection_parent:\n        ParentImage|endswith:\n            - 'systemd'\n            - '/init'\n    selection_shell:\n        Image|endswith:\n            - '/sh'\n            - '/bash'\n    selection_wrapper:\n        CommandLine|contains|all:\n            - 'export PATH='\n            - ';cd '\n            - ';exec '\n    condition: selection_parent and selection_shell and selection_wrapper\nfalsepositives:\n    - >-\n        Legitimate service units whose ExecStart wraps an export PATH plus cd plus exec\n        sequence in one shell invocation, uncommon but documented practice for relocatable\n        services\nlevel: high",
        "to_ids": true,
        "comment": "Shell Spawned by Systemd Executes Binary After Path Export and Directory Change | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1543.002 | rule hash 06617a27 | https://the-hunters-ledger.com/hunting-detections/gotenberg-rce-cryptomining-107-175-69-137-detections/",
        "timestamp": 1791692758,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      }
    ],
    "Object": []
  }
}