Inferlume

Detection Module 1: Jinja2 SSTI RCE Detection — SGLang /v1/rerank (CVE-2026-5760)

Detection Engineering Opportunities

• Monitor SGLang worker processes for unexpected child process spawns — shells, interpreters, download utilities — immediately following HTTP requests to /v1/rerank. Normal reranking operations produce no such child processes; any occurrence is a high-confidence anomaly matching the arbitrary code execution described by CERT/CC.

• Alert on SGLang log entries where previously unseen GGUF models are loaded immediately before application errors, crashes, or anomalous response times — a pattern consistent with exploitation attempts using malformed Jinja2 payloads in tokenizer.chat_template.

• Flag any modification of files outside known model storage directories by SGLang process users — post-exploitation behavior not seen in normal inference operations.

Detection Context Quality

• Effective detection requires three data sources in combination: SGLang application logs (model load events), EDR process creation telemetry (child process monitoring), and HTTP request logs capturing /v1/rerank access. Environments lacking Python-level process telemetry or HTTP request body logging will have significant blind spots.

• Because no IOCs have been published, static indicator matching is not possible. All detection is behavioral and baseline-dependent. Teams without an established SGLang process baseline should begin baselining immediately before deploying alert rules.

SIGMA Pseudocode — SGLang Shell Spawn on Rerank Endpoint

texttitle: SGLang Worker Process Spawning Command Interpreter — CVE-2026-5760 SSTI RCE Indicator
status: experimental
description: >
  Detects SGLang inference worker processes spawning unexpected shell or
  system utilities following HTTP POST activity to /v1/rerank.
  Behavioral basis: CERT/CC VU#915947 — Jinja2 SSTI payload in GGUF
  tokenizer.chat_template triggers arbitrary Python code execution.
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'python'
      - 'sglang'
      - 'uvicorn'
      - 'gunicorn'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/zsh'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - 'python3'
      - '/perl'
  condition: selection_parent AND selection_child
timeframe: 5m
falsepositives:
  - Legitimate SGLang maintenance or health-check scripts running under same
    parent process — suppress with allowlist of known internal scripts
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-5760

SIGMA Pseudocode — Suspicious GGUF Model Load Before Error Spike

texttitle: SGLang New GGUF Model Loaded Preceding Application Error Spike
status: experimental
description: >
  Detects new GGUF model introductions to SGLang environment correlated with
  a subsequent spike in application errors — consistent with malformed
  tokenizer.chat_template payload triggering CVE-2026-5760
logsource:
  category: application
  product: sglang
detection:
  selection_model_load:
    EventType: 'model_loaded'
    ModelPath|not_contains: '<known_trusted_model_registry>'
  selection_error_spike:
    EventType: 'error'
    ErrorCount|gte: 5        # tune based on environment baseline
  timeframe_correlation: 2m  # model load followed by errors within 2 min
  condition: selection_model_load FOLLOWED BY selection_error_spike
level: medium
falsepositives:
  - Legitimate new model deployments with transient load errors
tags:
  - attack.t1190
  - cve.2026-5760

SIGMA Pseudocode — SGLang Outbound Beacon to Unknown External IP (Pickle RCE)

texttitle: SGLang Process Outbound Connection to New External IP — CVE-2026-3059/3060 Indicator
status: experimental
description: >
  Detects network connections initiated by SGLang worker, multimodal, or
  disaggregation processes to previously unseen external IPs.
  Behavioral basis: SentinelLabs — unexpected external connections from
  SGLang workers are indicators of compromise for CVE-2026-3060.
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
      - 'sglang'
      - 'python'
    Initiated: 'true'
    DestinationIsIPv4: 'true'
  filter_rfc1918:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
  filter_known_registries:
    DestinationIp:
      - '<model_registry_ip_allowlist>'
      - '<internal_api_gateway_ip>'
  condition: selection AND NOT filter_rfc1918 AND NOT filter_known_registries
level: high
tags:
  - attack.t1190
  - cve.2026-3059
  - cve.2026-3060

SIEM Logic (Composite — Elastic/Splunk-compatible field references)

text// SGLang RCE Composite SIEM Detection
// Correlates HTTP rerank requests with child process anomalies

// Rule 1 — Shell Spawn
event.category:"process" AND
process.parent.name:("python*" OR "sglang*" OR "uvicorn" OR "gunicorn") AND
process.name:("sh" OR "bash" OR "curl" OR "wget" OR "nc" OR "python3") AND
NOT process.command_line:("<known_safe_patterns>")
→ ALERT: severity=HIGH | title="SGLang Shell Spawn — CVE-2026-5760 Indicator"

// Rule 2 — Correlate with prior /v1/rerank POST (5-min window)
http.request.method:"POST" AND
http.request.url.path:"/v1/rerank" AND
destination.ip:[sgLang_server_ip]
FOLLOWED BY Rule 1 within 5m on same host
→ ALERT: severity=CRITICAL | title="SGLang Rerank-to-Shell Correlation — Likely Exploitation"

// Rule 3 — Outbound beacon from SGLang host
network.direction:"outbound" AND
process.name:("python*" OR "sglang*") AND
NOT destination.ip:("<internal_cidr_ranges>") AND
NOT destination.ip:("<model_registry_allowlist>")
→ ALERT: severity=HIGH | title="SGLang Outbound to Unknown IP — CVE-2026-3059/3060"

YARA Pattern — Malicious GGUF Model Jinja2 SSTI Payload Detection (CVE-2026-5760)

textrule SGLang_GGUF_Jinja2_SSTI_Payload {
    meta:
        description  = "Detects GGUF model files containing Jinja2 SSTI payload
                         patterns consistent with CVE-2026-5760 exploitation
                         via malicious tokenizer.chat_template metadata"
        severity     = "critical"
        cve          = "CVE-2026-5760"
        source_basis = "CERT/CC VU#915947 — behavioral pattern from exploit
                        mechanism description. Not sourced from published IOC set."
        confidence   = "medium — high FP potential against GGUF files with
                        legitimate Python documentation in metadata"
        date         = "2026-04-21"
        author       = "Inferlume CTI"

    strings:
        // GGUF file format magic bytes
        $gguf_magic      = { 47 47 55 46 }             // "GGUF"

        // Jinja2 SSTI Python object traversal primitives
        $ssti_mro        = "__mro__"        ascii
        $ssti_subclass   = "__subclasses__" ascii
        $ssti_import     = "__import__"     ascii
        $ssti_builtins   = "__builtins__"   ascii
        $ssti_globals    = "__globals__"    ascii
        $ssti_class      = "__class__"      ascii

        // System execution primitives
        $exec_os_system  = "os.system"      ascii
        $exec_os_popen   = "os.popen"       ascii
        $exec_subprocess = "subprocess"     ascii
        $exec_popen      = "Popen"          ascii
        $exec_eval       = { 65 76 61 6C 28 }    // eval(

        // Jinja2 environment context strings
        $jinja_env       = "jinja2.Environment"   ascii
        $jinja_template  = "chat_template"        ascii

    condition:
        $gguf_magic at 0
        and $jinja_template
        and (
            ( 2 of ($ssti_*) )
            or ( any of ($exec_*) )
            or ( $jinja_env and any of ($ssti_*) )
        )
}

YARA Usage Note: This rule is behavioral — derived from CERT/CC's description of the exploit mechanism, not from a published indicator. Expected false-positive rate is non-zero against GGUF files that embed Python documentation or code examples in metadata fields. Validate against your model repository baseline before deploying in blocking mode. Use in detection/alert mode only initially.

D3FEND Countermeasures (SGLang RCE)

Threat Hunting Hypotheses — SGLang

• Hypothesis 1 (CVE-2026-5760): Any SGLang host that spawned a shell, interpreter, or download utility as a child process of a Python/SGLang worker within 5 minutes of an HTTP POST to /v1/rerank since April 20, 2026 may have been exploited. Evidence target: Correlate HTTP access logs with EDR process creation events on SGLang hosts.

• Hypothesis 2 (CVE-2026-5760): Any new GGUF model introduced to SGLang serving directories after April 20, 2026 from a source outside the organization's approved model registry should be quarantined and inspected. Evidence target: Audit file system creation events on model storage paths, correlate against approved model pull logs.

• Hypothesis 3 (CVE-2026-3059/3060): Any SGLang multimodal or disaggregation module host with outbound TCP connections to previously unseen public IPs after April 20, 2026 may reflect post-exploitation C2 activity. Evidence target: Network flow logs or EDR network telemetry vs. 30-day baseline of SGLang outbound connection patterns.

Immediate Detection Action (within 24h): Deploy behavioral alerts for SGLang child process anomalies and outbound connections to new external IPs. Establish process creation baseline for all SGLang worker processes. Enable HTTP request logging for /v1/rerank if not already active.

Hunt This Week: Conduct a retroactive hunt for SGLang process anomalies and new GGUF model introductions from outside approved registries since April 7, 2026 (CERT/CC notification date) to identify any latent compromise preceding today's public disclosure.

Detection Module 2: Cisco SD-WAN Control-Plane Abuse (CVE-2026-20127)

Detection Engineering Opportunities

• Alert on any addition of new SD-WAN peers from IP addresses not within the approved administrative subnet allowlist — the documented initial adversary action per CISA Hunt & Hardening Guidance referenced in NVD.

• Detect SD-WAN controller version downgrades initiated outside change management windows — a specific post-exploitation behavior observed in real-world exploitation of CVE-2026-20127 where attackers downgraded controllers to maintain access to a known-vulnerable version.

• Flag creation of new local user accounts on SD-WAN controllers or managers outside approved provisioning workflows — attackers created persistent local accounts as part of the documented TTP chain.

Detection Context Quality

• High-fidelity SD-WAN detection requires detailed controller audit logs, NETCONF session telemetry, and SSH session logs. Organizations collecting only perimeter firewall logs will miss control-plane manipulation events entirely.

• A 30–60 day retrospective hunt is warranted given March 2026 exploitation start date — active compromise may predate today's public reporting.

SIGMA Pseudocode — Cisco SD-WAN Unauthorized Peer Addition

texttitle: Cisco SD-WAN Controller — New Peer Added from Unauthorized Source
status: experimental
description: >
  Detects addition of new SD-WAN peers from IP addresses not in the approved
  administrative network ranges. Documented adversary behavior per CISA Hunt &
  Hardening Guidance for CVE-2026-20127 exploitation.
logsource:
  product: cisco-sdwan
  service: audit
detection:
  selection:
    EventType: 'peer_added'
    SourceIP|not_cidr:
      - '<approved_admin_subnet_1>'
      - '<approved_admin_subnet_2>'
  condition: selection
level: critical
falsepositives:
  - Scheduled legitimate SD-WAN expansion — correlate with change tickets
tags:
  - attack.t1190
  - cve.2026-20127

SIGMA Pseudocode — SD-WAN Controller Version Downgrade

texttitle: Cisco SD-WAN Controller — Version Downgrade Outside Change Window
status: experimental
description: >
  Detects SD-WAN controller or manager software version downgrade events —
  observed attacker behavior in CVE-2026-20127 exploitation: downgrade to
  vulnerable version, exploit secondary CVE, re-upgrade to maintain stealth.
logsource:
  product: cisco-sdwan
  service: audit
detection:
  selection:
    EventType: 'software_downgraded'
  filter_change_window:
    EventHour|gte: 8
    EventHour|lte: 18
    ChangTicketPresent: 'true'
  condition: selection AND NOT filter_change_window
level: critical
tags:
  - attack.t1190
  - cve.2026-20127

SIEM Logic (SD-WAN Composite)

text// Cisco SD-WAN Anomalous Control-Plane Activity
event.dataset:"cisco.sdwan.audit" AND
event.action IN (
  "peer_added",
  "route_modified",
  "user_created",
  "software_downgraded",
  "config_modified"
) AND (
  source.ip NOT IN [<approved_admin_subnets>]
  OR user.name NOT IN [<known_admin_accounts>]
  OR NOT (event.hour >= 8 AND event.hour <= 18)
)
→ ALERT: severity=CRITICAL
  title="SD-WAN Control-Plane Unauthorized Change — CVE-2026-20127 Indicator"
  priority=P1

// Local Account Creation Anomaly
event.dataset:"cisco.sdwan.audit" AND
event.action:"user_created" AND
actor.source NOT IN [<provisioning_system_ips>

D3FEND Countermeasures (SD-WAN)

Threat Hunting Hypotheses — Cisco SD-WAN

• Hypothesis 1 (CVE-2026-20127): Any SD-WAN controller that added peers, modified route configurations, or created local accounts between February 24 and today without corresponding change management tickets was potentially exploited. Evidence target: SD-WAN audit logs vs. change management CMDB records over 60 days.

• Hypothesis 2 (CVE-2026-20127): Any SD-WAN controller that underwent a software version downgrade followed by a re-upgrade within a 24-hour window reflects the documented attacker TTP of downgrading to exploit CVE-2022-20775 then restoring version. Evidence target: Software version history logs on all SD-WAN controllers.

• Hypothesis 3 (KEV — KACE, PaperCut, TeamCity): Admin logins to KEV-listed management platforms (Quest KACE, PaperCut, TeamCity, Kentico, Zimbra) from geolocations or IP ranges not previously seen in the last 90 days, followed by bulk configuration changes or software deployment events. Evidence target: Authentication logs correlated with network flow records.

Immediate Detection Action (within 24h): Enable and centralize audit logging on all Cisco SD-WAN controllers and managers, and all KEV-listed management platforms. Stand up P1 alerts for unauthorized configuration changes and new account creation. Verify NETCONF port (830) access is restricted to known administrative hosts via ACL.

Hunt This Week: Conduct a 60-day retrospective on SD-WAN controller audit logs covering peer additions, version changes, and local account creation events. Correlate all findings against change management records. Any unexplained delta should be treated as a potential indicator of CVE-2026-20127 exploitation.

Detection Module 3: PaperCut SecurityRequestFilter Bypass (CVE-2023-27351)

Detection Engineering Opportunities

• Alert on authentication events originating from IP addresses not in known PaperCut administrative access lists that result in a successful session — particularly targeting the admin interface or print management configuration.

• Monitor PaperCut server logs for API calls to the SecurityRequestFilter path from external or untrusted IP ranges, which represents the direct attack vector for CVE-2023-27351.

• Watch for post-authentication behavior patterns consistent with Lace Tempest historical TTP: script execution, service installation, new user creation, or software deployment via PaperCut's scripting interface within 30 minutes of a new session from an unknown source IP.

SIEM Logic (PaperCut)

text// PaperCut Auth Bypass and Post-Auth Anomaly
event.dataset:"papercut.server.audit" AND
event.action:"admin_login_success" AND
source.ip NOT IN [<known_admin_ips>] AND
source.ip NOT IN [<corporate_vpn_ranges>]
→ ALERT: severity=HIGH
  title="PaperCut Admin Login from Unknown Source — CVE-2023-27351 Indicator"

// Post-auth: software deployment or script execution within 30 min
event.action IN ("script_executed", "software_deployed", "user_created") AND
user.auth_source_ip NOT IN [<known_admin_ips>

D3FEND Countermeasures (PaperCut)

Immediate Detection Action (within 24h): Enable PaperCut server audit logging if not already active. Alert on successful admin logins from external IP ranges. Confirm PaperCut server is not internet-accessible.

Hunt This Week: Review PaperCut server logs from March 1, 2026 onward for successful authentication events from IP addresses outside known administrative ranges. Any hits warrant full IR investigation given the documented Lace Tempest/Cl0p ransomware delivery chain.

Detection Module 4: Microsoft SharePoint Zero-Day (CVE-2026-32201) + Defender Privilege Escalation (CVE-2026-33825)

Detection Engineering Opportunities

• Monitor SharePoint audit logs for user impersonation events, session token reuse from unexpected IP addresses, or access to sensitive document libraries from accounts that do not typically access them.

• Alert on Microsoft Defender service privilege changes or modification of Defender configuration outside patch deployment windows — CVE-2026-33825 was pre-disclosed before patch, extending the exploitable window.

SIEM Logic (SharePoint + Defender)

text// SharePoint Anomalous Access — CVE-2026-32201
event.dataset:"microsoft.sharepoint.audit" AND
event.action IN ("AccessRequest", "FileAccessed", "UserImpersonation") AND
(
  user.ip_address NOT IN [<known_user_ip_ranges>

Immediate Detection Action (within 24h): Confirm April 2026 Patch Tuesday deployment status via Intune/WSUS. Verify Defender platform version reflects post-CVE-2026-33825 patch state. Enable SharePoint unified audit log if not already active and streaming to SIEM.

Hunt This Week: Retroactive review of SharePoint access logs from April 14, 2026 (patch release date — exploitation confirmed at time of release) through today for anomalous authentication and access events from unusual source IPs or user agents.