Apache Shiro RCE & Linux Meterpreter Updates: Detection and Hardening Guide

---
title: Potential Linux Python Meterpreter Reverse Shell
id: 8a4d3b1e-6c9f-4a2e-b1d0-9f2e3a4b5c6d
status: experimental
description: Detects suspicious Python processes initiating network connections, indicative of Meterpreter or reverse shells.
references:
 - https://attack.mitre.org/techniques/T1059/004
author: Security Arsenal
date: 2026/05/08
tags:
 - attack.execution
 - attack.t1059.004
 - attack.command_and_control
 - attack.t1071
logsource:
 product: linux
 category: process_creation
detection:
 selection:
   Image|endswith:
     - '/python'
     - '/python3'
   CommandLine|contains:
     - '-c'
     - 'import socket'
     - 'import subprocess'
   Network:
   - true
 condition: selection
falsepositives:
 - Legitimate Python applications with network capabilities
level: high
---
title: Apache Shiro RememberMe Deserialization Attempt
id: 9b5e2c2f-7d0a-5b3f-c2e1-0a3f4b5c6d7e
status: experimental
description: Detects potential exploitation of Apache Shiro RememberMe deserialization via large base64-encoded cookies.
references:
 - https://attack.mitre.org/techniques/T1190
author: Security Arsenal
date: 2026/05/08
tags:
 - attack.initial_access
 - attack.t1190
 - attack.execution
 - attack.t1059
logsource:
 product: apache
 category: web
detection:
 selection:
   cs_cookie|contains: 'rememberMe='
 filter_legit:
     cs_cookie|re: '^rememberMe=[a-zA-Z0-9+/]{20,}={0,2}$'
 condition: selection and not filter_legit
falsepositives:
 - None (Base64 encoded serialized objects are rarely short)
level: high
---
title: FTP Anonymous Login Attempt
id: 1c2d3e4f-5a6b-7c8d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects successful FTP anonymous login attempts, indicating potential data staging or exposure.
references:
 - https://attack.mitre.org/techniques/T1078
author: Security Arsenal
date: 2026/05/08
tags:
 - attack.initial_access
 - attack.t1078
logsource:
 product: linux
 service: ftp
detection:
 selection:
   cs_method: 'PASS'
   cs_username: 'anonymous'
   response: '230'
 condition: selection
falsepositives:
 - Authorized public FTP repositories
level: medium

// Hunt for Python processes with network connections (Linux Syslog via CEF)
Syslog
| where ProcessName contains "python"
| where ProcessCommand contains "-c" or ProcessCommand contains "socket"
| extend DestinationPort = coalesce(column_extract("dport", Message), column_extract("dst_port", Message))
| where isnotempty(DestinationPort)
| project TimeGenerated, HostName, ProcessName, ProcessCommand, DestinationPort, Message
| summarize count() by bin(TimeGenerated, 5m), HostName, DestinationPort
| where count_ > 5

// Hunt for Apache Shiro RememberMe deserialization (Web Proxy/Firewall)
CommonSecurityLog
| where RequestURL contains ".do" or RequestURL contains ".jsp" // Common Java contexts
| where RequestHeaderFields contains "rememberMe="
| extend CookieLen = strlen(extract("rememberMe=([^;]+)", 1, RequestHeaderFields))
| where CookieLen > 100 // Heuristic: Serialized objects are large
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, DeviceAction, RequestHeaderFields

-- Hunt for suspicious Python processes
SELECT Pid, Name, Username, CommandLine,
       Exe, Ctime
FROM pslist()
WHERE Name =~ 'python.*'
  AND (CommandLine =~ '-c\s*import' 
       OR CommandLine =~ 'base64' 
       OR CommandLine =~ 'socket')

#!/bin/bash

# 1. Check for FTP servers allowing anonymous login
echo "[*] Checking FTP configuration for anonymous access..."
if command -v vsftpd &> /dev/null; then
    if grep -q "anonymous_enable=YES" /etc/vsftpd.conf 2>/dev/null; then
        echo "[!] WARNING: vsftpd anonymous access is ENABLED."
    else
        echo "[+] vsftpd anonymous access appears disabled."
    fi
elif command -v proftpd &> /dev/null; then
    if grep -q "Anonymous" /etc/proftpd/proftpd.conf 2>/dev/null; then
        echo "[!] WARNING: proftpd anonymous user found in config."
    else
        echo "[+] proftpd anonymous access appears disabled."
    fi
else
    echo "[?] No standard FTP daemon found or not running as expected service."
fi

# 2. Hunt for Apache Shiro jars (Heuristic)
echo "[*] Scanning common webapp directories for Apache Shiro jars..."
WEB_DIRS=("/var/www" "/opt/tomcat" "/usr/share/jetty" "/opt/jboss")

for dir in "${WEB_DIRS[@]}"; do
    if [ -d "$dir" ]; then
        echo "[+] Scanning $dir..."
        find "$dir" -name "shiro-core*.jar" -o -name "shiro-web*.jar" 2>/dev/null | while read -r jar; do
            echo "[!] Found Shiro Library: $jar"
            # Note: Remediation for Shiro requires changing code/Jars, not just config.
            # Verify version by unzipping jar if unzip is available
            if command -v unzip &> /dev/null; then
                ver=$(unzip -p "$jar" META-INF/MANIFEST.MF | grep "Implementation-Version" | cut -d: -f2)
                echo "    Version: $ver"
            fi
        done
    fi
done

echo "[*] Remediation Steps:"
echo "1. Disable anonymous FTP access immediately."
echo "2. Update Apache Shiro to version 1.2.5 or later."
echo "3. Ensure a custom, strong AES key is configured for Shiro CipherService (do not use defaults)."