Gyazo Data Breach: 23 Million Records Exposed via Image Upload Server Flaw — Detection and Hardening Guide

---
title: Web Server Process Spawning Shell or Interpreter
description: Detects web/upload server processes spawning command shells or scripting interpreters — a hallmark of webshell execution following exploitation of a file upload vulnerability, as seen in the Gyazo/Helpfeel upload server breach.
references:
  - https://securityaffairs.com/199338/data-breach/gyazo-data-breach-exposes-23-million-user-records.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
id: 3f8a1c92-7d4e-4b6a-9f21-5e0c8d2a7b13
status: experimental
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/nginx'
      - '/apache2'
      - '/httpd'
      - '/php-fpm'
      - '/node'
      - '/gunicorn'
      - '/uwsgi'
      - '/java'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate application plugins invoking system commands (rare in upload services)
  - Health-check scripts — scope to known service accounts if needed
level: high
---
title: Suspicious Executable or Script File Written to Web Upload Directory
description: Detects script/executable file creation in web upload or content directories, consistent with webshell deployment after exploitation of a file upload server flaw.
references:
  - https://securityaffairs.com/199338/data-breach/gyazo-data-breach-exposes-23-million-user-records.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
id: 9c2e5d47-1a8f-4b3c-8e62-0d4f7a9b3c51
status: experimental
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial_access
  - attack.t1190
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/uploads/'
      - '/upload/'
      - '/images/'
      - '/media/'
      - '/tmp/uploads/'
      - '/var/www/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.jsp'
      - '.jspx'
      - '.asp'
      - '.aspx'
      - '.py'
      - '.pl'
      - '.sh'
      - '.phtml'
      - '.phar'
  condition: selection_path and selection_ext
falsepositives:
  - Application deployments — exclude CI/CD service accounts and deploy windows
  - CMS media managers writing legitimate plugin files
level: high
---
title: Anomalous Large Outbound Transfer from Web or Database Server
description: Detects web tier hosts initiating large outbound connections to rare external destinations — consistent with bulk record exfiltration following database compromise via an exploited upload server.
references:
  - https://securityaffairs.com/199338/data-breach/gyazo-data-breach-exposes-23-million-user-records.html
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
id: 6b1d9e38-4c7a-4f2b-a5d8-3e9c1f6b2a74
status: experimental
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Initiated: 'true'
    Image|endswith:
      - '/curl'
      - '/wget'
      - '/mysqldump'
      - '/pg_dump'
      - '/tar'
      - '/zip'
      - '/rsync'
  filter_known:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_known
falsepositives:
  - Scheduled backup jobs — whitelist known backup tooling paths and destinations
  - CDN origin pulls (typically inbound, not initiated by the host)
level: medium

// Hunt: Webshell-style process execution and exfil indicators on upload/web tier hosts
// Tables assume Linux Syslog/CEF ingestion into Sentinel plus Defender for Endpoint where present

// 1) Web server processes spawning shells/interpreters (Linux via Syslog process events)
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in~ ("nginx", "apache2", "httpd", "php-fpm", "node", "gunicorn", "uwsgi", "java")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "python", "nc -", "ncat")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc;

// 2) Windows-hosted upload services: web worker processes spawning suspicious children
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "node.exe", "java.exe", "php-cgi.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "wget.exe", "certutil.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

// 3) Bulk outbound transfer from web/database tier hosts (exfil staging signal)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("curl", "wget", "mysqldump", "pg_dump", "tar", "rsync", "zip")
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), DistinctDestinations = dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where ConnectionCount > 50 or DistinctDestinations > 10
| order by ConnectionCount desc;

// 4) Web access log anomaly: spike in POSTs to upload endpoints from single sources (via CEF/Syslog W3C logs)
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod == "POST"
| where RequestURL has_any ("upload", "image", "media")
| summarize PostCount = count() by SourceIP, RequestURL, bin(TimeGenerated, 10m)
| where PostCount > 100
| order by PostCount desc;

-- Artifact: SecurityArsenal.UploadServerCompromiseHunt
-- Purpose: Identify webshell artifacts and suspicious child processes on upload/web tier hosts
-- following exploitation of a file upload vulnerability (Gyazo/Helpfeel breach pattern).

-- 1) Recently written script/executable files in upload and web content directories
SELECT FullPath, Size, Mtime, Ctime, Mode
FROM glob(globs=[
    '/var/www/**/*.php',
    '/var/www/**/*.phtml',
    '/var/www/**/*.sh',
    '/srv/uploads/**/*.php',
    '/srv/uploads/**/*.py',
    '/opt/**/uploads/**/*.jsp',
    '/tmp/uploads/**/*'
])
WHERE Mtime > Now() - 604800  -- last 7 days
ORDER BY Mtime DESC

-- 2) Web server processes with shell/interpreter children (live state)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(/bin/(ba)?sh|curl |wget |nc |ncat |python|perl)'
   OR Exe =~ '/(sh|bash|dash|nc|ncat)$'

-- 3) Established outbound connections from upload/db hosts to external IPs
SELECT Pid, Name, LocalAddr, RemoteAddr, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND NOT RemoteAddr =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

#!/usr/bin/env bash
# upload-server-audit.sh — Audit and harden a Linux image upload server
# against the exploitation pattern seen in the Gyazo/Helpfeel breach.
# Run as root. Review output before applying changes.
set -euo pipefail

REPORT="/root/upload-server-audit-$(date +%Y%m%d).txt"
exec > >(tee -a "$REPORT") 2>&1

echo "=== [1] Script/executable files in upload directories (webshell triage) ==="
UPLOAD_DIRS=("/var/www" "/srv/uploads" "/opt" "/tmp/uploads")
for d in "${UPLOAD_DIRS[@]}"; do
  [ -d "$d" ] && find "$d" -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \
    -o -name '*.jsp' -o -name '*.py' -o -name '*.pl' -o -name '*.sh' \) \
    -mtime -30 -printf '%TY-%Tm-%Td %p\n' 2>/dev/null
done

echo "=== [2] Web server processes with shell children (live) ==="
ps -eo pid,ppid,user,comm,args | grep -E 'nginx|apache2|httpd|php-fpm|node|gunicorn' | grep -v grep
ps -eo pid,ppid,comm,args | awk '$4 ~ /\/(ba)?sh|curl|wget|nc |ncat|python|perl/ {print}'

echo "=== [3] Recently modified files in web root (last 7 days) ==="
find /var/www /srv -type f -mtime -7 -printf '%TY-%Tm-%Td %u %p\n' 2>/dev/null | sort

echo "=== [4] World-writable directories under web roots ==="
find /var/www /srv -type d -perm -0002 2>/dev/null

echo "=== [5] Outbound established connections to public IPs ==="
ss -tnp state established | awk 'NR>1 {print $5, $7}' | grep -vE '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|\[::1\])' || true

echo "=== [6] Upload endpoint access spikes (nginx/apache logs, top POSTers) ==="
for log in /var/log/nginx/access.log /var/log/apache2/access.log; do
  [ -f "$log" ] && { echo "-- $log --"; grep '"POST' "$log" | grep -iE 'upload|image|media' | awk '{print $1}' | sort | uniq -c | sort -rn | head -20; }
done

echo "=== [7] HARDENING: disable script execution in upload dirs (nginx example) ==="
cat <<'EOF'
# Add to your nginx server block — upload dirs must NEVER execute code:
location ~* ^/uploads/.*\.(php|phtml|phar|py|pl|sh|jsp)$ { deny all; }
location /uploads/ {
    location ~ \.php$ { deny all; }
}
# Apache equivalent (.htaccess in the upload dir):
#   php_flag engine off
#   RemoveHandler .php .phtml .phar
#   Options -ExecCGI
EOF

echo "=== [8] HARDENING: enforce content-type + magic-byte validation and size limits ==="
cat <<'EOF'
# Application-layer checklist:
#  - Validate file type by magic bytes (libmagic/file command), NOT client MIME header
#  - Re-encode/strip images through a sandboxed parser (e.g., isolated ImageMagick with
#    a restrictive policy.xml — disable coders: PS, PDF, SVG, MVG, TEXT, LABEL, HTTP, URL)
#  - Rename uploads server-side (random names); never trust client filenames (path traversal)
#  - Store uploads outside web root or on object storage; serve via signed URLs
#  - Mount upload filesystem noexec,nosuid,nodev
#  - Network-segment the upload service: no direct DB credentials; egress firewall deny-by-default
#  - Cap request body size (nginx: client_max_body_size 10m;)
EOF

echo "=== Audit complete. Report saved to $REPORT ==="