From Mandiant's writeup: initial POSTs to /app_84304470%2Ephp, then the SAWFLY PHP web shell (mangoapi.php) under .../ingredi/app/laravel/public/. SAWFLY returns 404 unless a POST carries the parameter _c94mfe, then Base32-decodes and RC4-decrypts it and runs it with eval(). For root, the actor copied /bin/sh to /usr/bin/dbus-authd, chowned it to root and set SUID. It dumped credentials with /ns/sbin/bt-secrets get ... vault and then deleted /home/bomgar/log/bt-secrets.log*; it also used a BARECLAW tunneler and wiped logs. BeyondTrust adds behavioral hunts: admin sessions from residential broadband or commercial VPN exits you can't tie to a ticket, new script files in web directories, web service accounts spawning shells, changed Jump Item or Team permissions, and log-forwarding gaps that open and close within one session. Because on-box logs may be gone or tampered with, rely on off-box SIEM copies. Mandiant's post includes hashes and YARA rules.