CVE-2024-3721: TBK DVR Command Injection & Nexcorium Mirai Variant — Detection and Remediation

---
title: TBK DVR Command Injection - Web Server Spawning Shell
id: 88c4d1f2-3b4a-4c9d-8e1f-2a3b4c5d6e7f
status: experimental
description: Detects potential command injection on TBK DVRs or IoT web servers by identifying the web server process spawning a shell or network tool.
references:
  - https://fortiguard.com/encycirus/threat?id=4567
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/lighttpd'
      - '/mini_httpd'
      - '/goahead'
      - '/webs'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/busybox'
      - '/wget'
      - '/curl'
      - '/tftp'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative web interfaces executing scripts (rare in IoT)
level: critical
---
title: Nexcorium Mirai Variant - Suspicious Binary Download
id: 99d5e2g3-4c5b-5d0e-9f2g-3b4c5d6e7f8g
status: experimental
description: Detects the download of binaries to common IoT writable directories (/tmp, /var, /dev) often used by Mirai variants like Nexcorium.
references:
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_tools:
    Image|endswith:
      - '/wget'
      - '/curl'
      - '/tftp'
      - '/busybox'
  selection_args:
    CommandLine|contains:
      - 'http://'
      - 'ftp://'
  selection_paths:
    CommandLine|contains:
      - '/tmp/'
      - '/var/'
      - '/dev/'
      - '/shm/'
  condition: all of selection_*
falsepositives:
  - Legitimate system updates or administrative downloads
level: high

// Hunt for TBK DVR exploitation via Syslog or CommonSecurityLog
// Looks for command injection patterns in HTTP logs or suspicious process execution
//
// 1. Check Web Logs for Command Injection Syntax
CommonSecurityLog
| where DeviceVendor in ("TBK", "Generic", "Palo Alto Networks", "Fortinet")
| where RequestURL contains ";" 
   or RequestURL contains "&&" 
   or RequestURL contains "|" 
   or RequestURL contains "`"
| project TimeGenerated, DeviceName, SourceIP, DestinationIP, RequestURL, RequestMethod
| extend AlertContext = "Potential Command Injection in URL"
//
// 2. Check Process Logs for Web Server Spawning Shells (Linux/Syslog)
union Syslog, DeviceProcessEvents 
| where ProcessName has_any ("sh", "bash", "dash", "busybox")
| where ParentProcessName has_any ("httpd", "lighttpd", "mini_httpd", "goahead", "webs")
| project TimeGenerated, DeviceName, ProcessName, ParentProcessName, CommandLine
| extend AlertContext = "Web Server spawned shell - Potential RCE"

-- Hunt for Nexcorium/Mirai infection indicators on Linux/DVR endpoints
-- Looks for suspicious processes running from hidden directories and established C2 connections

SELECT 
  Pid, 
  Ppid, 
  Name, 
  Exe, 
  Username, 
  CommandLine,
  Ctime AS ProcessCreateTime
FROM pslist()
WHERE 
  Exe =~ '/tmp/.*' 
  OR Exe =~ '/dev/.*' 
  OR Exe =~ '/var/.*' 
  OR Name IN ('nxc', 'dvrHelper', 'systemd', 'sshd') 
  AND CommandLine != ''

UNION SELECT 
  Family, 
  State, 
  RemoteAddr, 
  RemotePort, 
  Pid
FROM listen_sockets()
WHERE 
  RemotePort IN (23, 2323, 5555, 6667, 8080, 8443) 
  OR State = 'ESTABLISHED'
  AND Pid > 0

#!/bin/bash
# Remediation script for CVE-2024-3721 and Nexcorium Mirai
# This script attempts to kill known malicious processes and block inbound http from untrusted nets.
# Note: Patching the firmware is the only permanent fix.

echo "[+] Starting Remediation for CVE-2024-3721 / Nexcorium..."

# 1. Kill suspicious processes often associated with Mirai variants
MALICIOUS_PROCS=("nxc" "dvrHelper" "." "sh" "bash")

for proc in "${MALICIOUS_PROCS[@]}"; do
    # Find PIDs (be careful with system shells, this is a targeted hunt)
    if [[ "$proc" != "sh" && "$proc" != "bash" ]]; then
        pkill -9 -f "$proc"
        echo "[!] Killed process: $proc"
    else
        # Only kill shell if spawned by httpd (example heuristic)
        ps aux | grep 'httpd.*sh' | awk '{print $2}' | xargs -r kill -9
        echo "[!] Killed potential web-shell (httpd->sh)"
    fi
done

# 2. Remove known malicious binary locations
rm -f /tmp/nxc* /tmp/.nxc* /var/nxc* /dev/nxc*
rm -f /tmp/dvrHelper* /dev/shm/
echo "[!] Attempted removal of Nexcorium binaries in /tmp, /var, /dev"

# 3. Firewall - Block inbound HTTP/HTTPS from WAN (if iptables exists)
# WARNING: Adjust interface names (e.g., eth0) to match your environment.
if command -v iptables &> /dev/null; then
    echo "[+] Configuring iptables to drop inbound HTTP/HTTPS from external interface..."
    # Replace eth0 with your WAN interface. Comment out if management is required.
    # iptables -I INPUT -i eth0 -p tcp --dport 80 -j DROP
    # iptables -I INPUT -i eth0 -p tcp --dport 8080 -j DROP
    # iptables -I INPUT -i eth0 -p tcp --dport 443 -j DROP
    echo "[!] Please verify iptables rules. Manual intervention required to lock down management interfaces."
else
    echo "[!] iptables not found. Manual firewall filtering required."
fi

echo "[+] Remediation complete. IMMEDIATE ACTION: Update TBK DVR Firmware or replace device."