The vendor warns that updating or patching may erase attack traces, so first download and keep SiteGuard's diagnostic information (web admin console, Diagnostic Info, Download) on every affected host. Then hunt back to at least late September (the vendor told support customers on Sept 29, so exploitation may predate the public alert): look for shells or unexpected commands spawned by SiteGuard's statistics processing running as root/SYSTEM, new local accounts, cron jobs, services or scheduled tasks, and files changed under the SiteGuard install and statistics directories. Because the bug needs a low-privileged local account, pair it with a hunt for the initial foothold on the same web server (web shells, low-privilege service accounts running interactive commands).