{"id":10144,"date":"2026-01-26T04:03:38","date_gmt":"2026-01-26T04:03:38","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/26\/32654\/"},"modified":"2026-01-26T04:03:38","modified_gmt":"2026-01-26T04:03:38","slug":"32654","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/26\/32654\/","title":{"rendered":"Scanning Webserver with \/$(pwd)\/ as a Starting Path, (Sun, Jan 25th)"},"content":{"rendered":"\n
Scanning Webserver with \/$(pwd)\/ as a Starting Path, (Sun, Jan 25th)<\/div>\n

\t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Based on the sensors reporting to ISC, this activity started on the 13 Jan 2026. My own sensor started seeing the first scan on the 21 Jan 2026 with limited probes. So far, this activity has been limited to a few scans based on the reports available in ISC [5<\/a>]\u00a0(select Match Partial URL and Draw<\/span>):<\/p>\n

\"\"<\/p>\n

This is a sample list of the directories actors are scanning for using the following patterns:<\/p>\n

\/$(pwd)\/.env.staging
\n\/$(pwd)\/.env.development
\n\/$(pwd)\/.env.production
\n\/$(pwd)\/.env.local
\n\/$(pwd)\/.env
\n$(pwd)\/terraform.tfstate
\n\/$(pwd)\/docker-compose.yml
\n\/$(pwd)\/netlify.toml<\/p>\n

This Gephi<\/a> graph shows the relationship of each probed URL by the two IP addresses:<\/p>\n

\n\"\"<\/p>\n

Kibana ES|QL Query<\/strong><\/span><\/p>\n

FROM cowrie*\u00a0
\n| WHERE event.reference == “no match”
\n| KEEP related.ip,http.request.body.content
\n| WHERE http.request.body.content IS NOT NULL
\n| WHERE http.request.body.content RLIKE “.*\\\/\\$\\(pwd\\).*”
\n| STATS COUNT(http.request.body.content) BY related.ip, http.request.body.content<\/span><\/p>\n

Indicators<\/strong><\/span><\/p>\n

By selecting one of these two indicators, it shows their scanning activity for the\u00a0\/$(pwd)\/<\/span> pattern in the ISC web logs.<\/p>\n

185.177.72.52<\/a>
\n185.177.72.23<\/a><\/p>\n

We also appreciate feedback and suggestions about what tool is used to perform these scans. Please use our contact<\/a> page to provide feedback.\u00a0<\/p>\n

[1] https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/8.19\/esql-using.html
\n[2] https:\/\/gephi.org\/
\n[3] https:\/\/isc.sans.edu\/weblogs\/sourcedetails.html?date=2026-01-21&ip=185.177.72.52
\n[4] https:\/\/isc.sans.edu\/weblogs\/sourcedetails.html?date=2026-01-25&ip=185.177.72.23
\n[5] https:\/\/isc.sans.edu\/weblogs\/urlhistory.html?url=LyQocHdkKS8uCg==<\/p>\n

———–
\nGuy Bruneau IPSS Inc.<\/a>
\nMy GitHub Page<\/a>
\nTwitter: GuyBruneau<\/a>
\ngbruneau at isc dot sans dot edu<\/p>\n

(c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n

\t

\n
<\/BR><\/p>\n

\t

\n
<\/BR>
\nGo to isc.sans.edu<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Scanning Webserver with \/$(pwd)\/ as a Starting Path, (Sun, Jan 25th) Based on the sensors reporting to ISC, this activity started on the 13 Jan 2026. My own sensor started seeing the first scan on the 21 Jan 2026 with limited probes. So far, this activity has been limited to a few scans based on […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[56],"tags":[69],"class_list":["post-10144","post","type-post","status-publish","format-standard","hentry","category-isc-sans-edu","tag-isc-sans-edu"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10144"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10144"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10144\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10144"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10144"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10144"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}