Inventory remaining D-Link DIR-868L (and similar CoBos-era) units; prefer asset tags/firmware banners over hostname alone. Alert on inbound HTTP(S) to port 80/443 with path /HNAP1/ and SOAPACTION headers containing GetDeviceSettings plus shell metacharacters (semicolon, backtick, dollar-paren, pipe). On the LAN, look for unexpected root shell children of the web CGI and NVRAM/config changes from non-admin stations. Because the product is EOL with a public PoC, treat any WAN-reachable management UI as compromise-likely until replaced.

# rough hunt idea
# HTTP /HNAP1/ + SOAPACTION containing GetDeviceSettings and shell metacharacters
# correlate with unexpected uid=0 children of cgibin / httpd