title: Zimbra swatch/dosnmp Command Injection via Injected SMTP Field (CVE-2026-73570)
id: 8f1c2a4e-6d3b-4f0a-9c7e-2e5a8d1b4c01
status: reviewed
description: >
    Detects a shell process spawned by a Perl process (swatchdog) whose command line
    decodes base64 content into a shell or opens a /dev/tcp socket. This is the
    post-exploitation signature of CVE-2026-73570: the zimbra-snmp swatch watchfor
    feeds an attacker-controlled SMTP recipient field into the dosnmp() backtick
    command, which /bin/sh executes as the zimbra user.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73570
    - https://github.com/Zimbra/zm-build/commit/c4837c66360979d757890271f6c976727e71bcad
    - CERT Polska 145/2026
author: Xpectra Security Research
date: 2026/08/24
tags:
    - attack.execution
    - attack.t1059.004
    - attack.initial_access
    - attack.t1190
logsource:
    product: linux
    category: process_creation
detection:
    parent:
        ParentImage|ParentImageName|image|Image|process:
            - '*perl*'          # swatchdog is a perl process
            - '*swatchdog*'
    child_img:
        Image|image|process:
            - '/bin/sh'
            - '/bin/bash'
            - '*/sh'
    cmd_b64:
        CommandLine|CommandLineRaw|arguments|argumentsRaw:
            - 'base64'
            - ' -d'
            - '|sh'
            - '|bash'
    cmd_tcp:
        CommandLine|CommandLineRaw|arguments|argumentsRaw:
            - '/dev/tcp/'
    condition: parent and child_img and (2 of cmd_b64 or cmd_tcp)
fields:
    - User
    - ParentCommandLine
falsepositives:
    - Legitimate monitoring jobs that pipe base64 into a shell (rare under perl parents)
level: high