# ============================================================================
# cve2026_73570_suricata.rules — Xpectra Security Research (2026-08-24)
# Network-layer detection for CVE-2026-73570 (Zimbra zimbra-snmp RCE).
#
# Rule 1 catches the injection ATTEMPT on the SMTP channel (works even when
# the sink is patched - attempt detection).
# Rule 2 catches the reverse-shell EGRESS stage (works on any host running
# Zimbra; tune $ZIMBRA_NET to your mail-server ranges).
#
# Install: append to suricata.yaml rule-files, or drop into /etc/suricata/rules/
# ============================================================================

var ZIMBRA_NET $HOME_NET

# --- 1. SMTP RCPT/MAIL carrying shell command substitution -----------------
# A legitimate address local-part never contains "$(". Match the metacharacter
# sequence on SMTP request lines (RCPT TO / MAIL FROM / DATA subject).
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 ( \
    msg:"CVE-2026-73570 SMTP RCPT with shell command substitution (zimbra-snmp sink attempt)"; \
    flow:to_server; \
    content:"RCPT TO:"; nocase; \
    content:"$("; distance:0; within:120; \
    classtype:web-application-attack; \
    sid:20267357; rev:1; \
    metadata:cve:"2026-73570", created:"2026_08_24", author:"Xpectra Security Research"; \
)

alert tcp $EXTERNAL_NET any -> $HOME_NET 25 ( \
    msg:"CVE-2026-73570 SMTP MAIL FROM with shell command substitution (zimbra-snmp sink attempt)"; \
    flow:to_server; \
    content:"MAIL FROM:"; nocase; \
    content:"$("; distance:0; within:120; \
    classtype:web-application-attack; \
    sid:20267358; rev:1; \
    metadata:cve:"2026-73570", created:"2026_08_24", author:"Xpectra Security Research"; \
)

# --- 2. Reverse-shell egress from a Zimbra server ---------------------------
# Zimbra servers initiate outbound SMTP/IMAP/HTTP(S) to well-known peers only.
# An outbound connection from a mail server to a high port on a non-mail
# host is the reverse-shell beacon of the exploitation chain.
alert tcp $ZIMBRA_NET any -> !$ZIMBRA_NET any ( \
    msg:"CVE-2026-73570 potential reverse-shell egress from Zimbra server (high-port outbound)"; \
    flow:established,to_server; \
    dport > 1024; \
    dport != 443; dport != 587; dport != 25; dport != 993; dport != 995; dport != 2083; \
    classtype:non-shell-code; \
    sid:20267359; rev:1; \
    metadata:cve:"2026-73570", created:"2026_08_24", author:"Xpectra Security Research"; \
)