index=web_logs OR index=proxy_logs
| where clientip IN ("200.107.207.26","185.181.60.11") OR dest_ip IN ("200.107.207.26","185.181.60.11")
| stats count by clientip, dest_ip, uri, method, useragent, _time
| sort - count

index=web_logs sourcetype=access_combined
| where (uri LIKE "%UiServlet%" OR uri LIKE "%/OA_HTML/%") AND method="POST"
| where NOT cidrmatch("10.0.0.0/8", clientip)  // adjust for your internal ranges
| stats count by clientip, uri, useragent, _time
| sort - count

index=endpoint_events sourcetype=os_process
| where process_cmdline LIKE "%/bin/bash -i%/dev/tcp/%" OR process_cmdline LIKE "%/dev/tcp//%"
| table _time host user process_name process_cmdline parent_process

http.request.method : "POST" and (http.request.uri : "*UiServlet*" or http.request.uri : "/OA_HTML/*") and not client.ip : ("10.0.0.0/8")

event.type: "file" and file.hash.sha256 : ("76b6d36e04e3...", "aa0d3859d66...", "6fd538e4a8e3...")

#!/usr/bin/env python3
"""
ebs_safe_hunt.py — Safe log parser for CVE-2025-61882 indicators.

Usage:
    python3 ebs_safe_hunt.py /path/to/access.log

Notes:
 - Parses Apache/Nginx combined log lines.
 - Flags UiServlet/OA_HTML POSTs, malicious IPs from Oracle advisory,
   shell stager patterns, and observed SHA256 hashes.
 - Safe: no network / no exploit execution.
"""

import sys
import re
from collections import Counter, defaultdict

# Regex for common combined log format
LOG_PATTERN = re.compile(
    r'(?P<ip>\S+) \S+ \S+ \[(?P<time>.*?)\] "(?P<method>\S+) (?P<uri>\S+) \S+" (?P<status>\d{3}) (?P<size>\S+) "(?P<ref>[^"]*)" "(?P<ua>[^"]*)"'
)

# Oracle-provided IOCs
MALICIOUS_IPS = {"200.107.207.26", "185.181.60.11"}
MALICIOUS_HASHES = {
    "76b6d36e04e367a2334c445b51e1ecce97e4c614e88dfb4f72b104ca0f31235d",
    "aa0d3859d6633b62bccfb69017d33a8979a3be1f3f0a5a4bf6960d6c73d41121",
    "6fd538e4a8e3493dda6f9fcdc96e814bdd14f3e2ef8aa46f0143bff34b882c1b",
}
SHELL_PATTERN = "/bin/bash -i"  # we search for this substring (reverse shell style)
SUSPICIOUS_PATHS = ["UiServlet", "/OA_HTML/"]

# Optional: list of suspicious user-agents often used by scanners
SUSPICIOUS_UAS = ["curl", "wget", "python-requests", "nikto", "sqlmap", "masscan", "Nmap"]

def analyze_log(path):
    ip_counts = Counter()
    uri_counts = Counter()
    ua_counts = Counter()
    suspicious = defaultdict(list)

    with open(path, "r", errors="replace") as fh:
        for line_no, line in enumerate(fh, 1):
            m = LOG_PATTERN.search(line)
            if not m:
                # Optionally, still check for hashes or shell pattern in unstructured lines
                if any(h in line for h in MALICIOUS_HASHES):
                    suspicious["malicious_hash_lines"].append((line_no, line.strip()))
                if SHELL_PATTERN in line or "/dev/tcp/" in line:
                    suspicious["shell_pattern_lines"].append((line_no, line.strip()))
                continue

            ip = m.group("ip")
            method = m.group("method")
            uri = m.group("uri")
            ua = m.group("ua")
            size = m.group("size")

            ip_counts[ip] += 1
            uri_counts[uri] += 1
            ua_counts[ua] += 1

            # 1) Malicious IPs (Oracle)
            if ip in MALICIOUS_IPS:
                suspicious["malicious_ips"].append((line_no, ip, method, uri, ua))

            # 2) POSTs to suspicious EBS paths
            if method.upper() == "POST" and any(p in uri for p in SUSPICIOUS_PATHS):
                suspicious["servlet_posts"].append((line_no, ip, uri, ua))

            # 3) Suspicious user agents (scanners)
            if any(k.lower() in ua.lower() for k in SUSPICIOUS_UAS):
                suspicious["suspicious_ua"].append((line_no, ip, uri, ua))

            # 4) Very large responses (possible exfil) — tune threshold for your environment
            try:
                if size != "-" and int(size) > 5_000_000:  # >5MB
                    suspicious["large_responses"].append((line_no, ip, uri, size))
            except ValueError:
                pass

            # 5) Shell stager pattern or /dev/tcp patterns in the line
            if SHELL_PATTERN in line or "/dev/tcp/" in line:
                suspicious["shell_stager"].append((line_no, ip, uri, line.strip()))

            # 6) Known malicious file hashes present in logs (if available)
            for h in MALICIOUS_HASHES:
                if h in line:
                    suspicious["malicious_hash"].append((line_no, ip, uri, h))

    return {
        "ip_counts": ip_counts,
        "uri_counts": uri_counts,
        "ua_counts": ua_counts,
        "suspicious": suspicious
    }

def pretty_report(r, top=10):
    print("\n=== EBS HUNT REPORT ===\n")
    print("Top source IPs:")
    for ip, c in r["ip_counts"].most_common(top):
        print(f"  {ip}: {c}")
    print("\nTop URIs:")
    for uri, c in r["uri_counts"].most_common(top):
        print(f"  {uri}: {c}")
    print("\nTop User-Agents:")
    for ua, c in r["ua_counts"].most_common(top):
        print(f"  {ua}: {c}")

    print("\nSuspicious findings:")
    if not r["suspicious"]:
        print("  None found.")
        return

    for k, items in r["suspicious"].items():
        print(f"\n-- {k} ({len(items)} matches) --")
        for item in items[:100]:
            print("  " + " | ".join(map(str, item)))

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python3 ebs_safe_hunt.py /path/to/access.log")
        sys.exit(1)
    path = sys.argv[1]
    result = analyze_log(path)
    pretty_report(result)

python3 ebs_safe_hunt.py /path/to/access.log