#!/bin/bash
# Identify processes loading libz.so and check package version
echo "=== Package Version Check ==="
dpkg -l | grep zlib1g

echo -e "\n=== Processes with libz.so loaded ==="
sudo lsof | grep libz.so | awk '{print $1}' | sort -u

echo -e "\n=== Binary linkage check (sample) ==="
for bin in /usr/sbin/nginx /usr/sbin/sshd /usr/bin/python3; do
    if [ -f "$bin" ]; then
        echo "Checking $bin:"
        ldd "$bin" 2>/dev/null | grep -i libz || echo "  - Not dynamically linked to libz"
    fi
done

echo -e "\n=== Static linkage detection (advanced) ==="
find /usr/local/bin /opt -type f -executable 2>/dev/null | while read binary; do
    if strings "$binary" 2>/dev/null | grep -q "zlib version"; then
        echo "POTENTIAL STATIC LINK: $binary"
    fi
done

---
title: Zlib Crash Followed by Shell Execution
id: 8a4f9c21-3b7d-4e9f-b1a2-9c8d7e6f5a4b
status: experimental
description: Detects abnormal termination of zlib-dependent processes followed immediately by shell execution, indicating potential RCE exploitation.
references:
  - https://security-tracker.debian.org/tracker/DSA-6613-1
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/nginx'
      - '/apache2'
      - '/sshd'
      - '/python3'
      - '/php-fpm'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative scripts spawned by web servers (rare)
  - Development environments with debugger attachments
level: high
---
title: Zlib-Dependent Service Crash Detection
id: 9b5e8d32-4c8e-5f0a-c2b3-0d9e8f7a6b5c
status: experimental
description: Identifies segmentation faults or aborts in processes linked against zlib, potentially indicating exploitation attempts or DoS attacks.
references:
  - https://security-tracker.debian.org/tracker/DSA-6613-1
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/nginx'
      - '/sshd'
      - '/httpd'
      - '/openssl'
    CommandLine|contains:
      - 'zlib'
      - 'gzip'
      - 'deflate'
  filter_status:
    ExitStatus: 139  # SIGSEGV
    ExitStatus: 134  # SIGABRT
    ExitStatus: 136  # SIGFPE
  condition: selection and filter_status
falsepositives:
  - Normal service restarts or configuration reloads
  - Development debugging sessions
level: medium
---
title: Anomalous Network Activity from Compression Libraries
id: 7c6f9e43-5d9f-6a1b-d3c4-1e0f9a8b7c6d
status: experimental
description: Detects unexpected outbound connections from zlib-dependent processes following potential decompression operations.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/nginx'
      - '/sshd'
      - '/python3'
      - '/curl'
      - '/wget'
    DestinationPort:
      - 443
      - 80
      - 8080
      - 53
  filter_known_good:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '8.8.8.8/32'
  condition: selection and not filter_known_good
falsepositives:
  - Legitimate API calls from web applications
  - Package manager updates
level: medium

// Hunt for zlib-dependent process crashes followed by shell execution
let timeWindow = 5m;
let zlibProcesses = dynamic(["nginx", "sshd", "apache2", "httpd", "php-fpm", "python3"]);
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4688  // Process creation
| where ProcessName has_any (zlibProcesses)
| summarize StartTime=min(TimeGenerated) by Computer, ProcessName, NewProcessName, CommandLine
| join kind=inner (
    SecurityEvent
    | where TimeGenerated > ago(24h)
    | where EventID == 4688
    | where NewProcessName endswith "sh" or NewProcessName endswith "bash" or NewProcessName endswith "dash"
    | project ShellTime=TimeGenerated, Computer, ShellCommand=CommandLine, ParentProcess=ProcessName
) on Computer
| where ShellTime between (StartTime .. StartTime + timeWindow)
| project Computer, VulnerableService=ProcessName, CrashTime=StartTime, ShellSpawned=NewProcessName, ShellCommand, ShellTime
| order by CrashTime desc

// Alternative: Syslog-based detection for Debian systems forwarding to Sentinel
Syslog
| where TimeGenerated > ago(24h)
| where Facility == "user" or Facility == "daemon"
| where SyslogMessage contains "segfault" or SyslogMessage contains "zlib" or SyslogMessage contains "deflate"
| where SyslogMessage has_any (zlibProcesses)
| parse SyslogMessage with * "segfault at " SegfaultAddress " ip " InstructionPointer " sp " StackPointer " error " ErrorCode " in " Library "["*
| project TimeGenerated, Computer, ProcessName, SegfaultAddress, InstructionPointer, Library
| order by TimeGenerated desc

-- Hunt for vulnerable zlib versions and suspicious process memory maps
SELECT 
    Pid,
    Name as ProcessName,
    Exe as ExecutablePath,
    CommandLine,
    Username,
    CreateTime,
    {
        SELECT 
            Path as LoadedLibrary,
            MappedSize
        FROM psmaps(pid=Pid)
        WHERE Path =~ "libz"
    } as ZlibLibraries
FROM pslist()
WHERE 
    Name =~ "nginx|sshd|apache|httpd|python|php"
    OR CommandLine =~ "zlib|gzip|deflate"
ORDER BY CreateTime DESC

   Update all Debian systems using the standard package manager. Due to library caching, you **must restart** dependent services or reboot the host to ensure the new library is loaded into memory.

# Update package lists and install security update
sudo apt-get update
sudo apt-get install --only-upgrade zlib1g zlib1g-dev

# Verify installation
dpkg -l | grep zlib1g

# Restart critical services (customize based on your environment)
sudo systemctl restart sshd nginx apache2 php-fpm docker containerd

# For systems where reboot is feasible (preferred for full library reload)
sudo reboot

3. **Container and Image Hygiene**
   
   Zlib vulnerabilities propagate through container images. Rebuild all images using Debian base layers:

   ```bash
# Pull updated base images
docker pull debian:stable
docker pull debian:stable-slim

# Rebuild application images
docker build --no-cache -t yourapp:latest .

# Verify no vulnerable layers persist
docker scout cves yourapp:latest --only-fixed