Inferlume

title: Arista VeloCloud Orchestrator SQL Injection Privilege Escalation
id: 7f3a91c2-0001-4b8e-9d31-velocloud-cve-2026-114625
status: experimental
description: Detects suspicious SQL injection attempts against VeloCloud Orchestrator or anomalous elevation from read only to superuser operator
logsource:
  product: arista_velocloud_orchestrator
  service: web_access
detection:
  selection_known_ips:
    src_ip:
      - '74.82.197.86'
      - '38.54.50.151'
  selection_sql_syntax:
    http_url|contains_any:
      - 'union+select'
      - 'union%20select'
      - 'information_schema'
      - 'pg_sleep'
      - '%27'
      - '%22'
      - '--'
  selection_privilege_change:
    event_action:
      - 'role_change'
      - 'privilege_escalation'
    new_role:
      - 'operator'
      - 'superuser'
      - 'local_superuser'
  condition: selection_known_ips or selection_sql_syntax or selection_privilege_change
falsepositives:
  - Legitimate authorized administrative upgrades
level: critical

title: PHP2Shell Session Manipulation and RCE Attempt
id: 8b1a32d4-php2shell-session-exploit-2026
status: experimental
description: Detects abnormal session cookie manipulation and session upload progress queries indicative of CVE-2026-109618 exploitation
logsource:
  category: webserver
detection:
  selection_uri:
    cs_uri_query|contains:
      - 'PHP_SESSION_UPLOAD_PROGRESS'
      - 'upload_progress'
  selection_target:
    cs_uri_stem|endswith:
      - '.php'
  selection_cookie:
    cs_Cookie|contains:
      - 'PHPSESSID'
  condition: selection_uri and selection_target and selection_cookie
falsepositives:
  - Legitimate custom web applications tracking file upload percentages
level: high

title: Storm-0940 ARTEX Cloud Application Role Manipulation
id: c4e901b2-artex-cloud-privesc-2026
status: experimental
description: Detects service principal addition of high privilege directory roles or new application credentials
logsource:
  category: cloud_audit
  product: azure
detection:
  selection_role:
    operationName: 'Add member to role'
    targetResources.roleName:
      - 'Global Administrator'
      - 'Privileged Role Administrator'
  selection_actor:
    initiatedBy.app.servicePrincipalId: '*'
  selection_credential:
    operationName: 'Add service principal credentials'
  condition: (selection_role and selection_actor) or selection_credential
falsepositives:
  - Authorized automated DevOps deployments
level: critical

title: Potassium Botnet Command and Control Traffic
id: e3d2194a-potassium-c2-beacon-2026
status: stable
description: Detects outbound communication to reported Potassium C2 infrastructure across TCP port 50792
logsource:
  category: network_connection
detection:
  selection_c2:
    DestinationIp:
      - '134.199.154.64'
      - '92.118.112.100'
    DestinationPort: 50792
  selection_dns:
    QueryName|endswith:
      - 'thunder.godofthunder.st'
  condition: selection_c2 or selection_dns
falsepositives:
  - Threat research sandbox testing
level: critical

SELECT
  event.timestamp,
  host.hostname,
  process.parent.name AS parent_process,
  process.name AS spawned_process,
  process.command_line,
  user.name AS executed_user
FROM process_events
WHERE process.parent.name IN ('php-fpm', 'php-cgi', 'apache2', 'httpd', 'nginx')
  AND process.name IN ('sh', 'bash', 'dash', 'curl', 'wget', 'python', 'perl', 'nc', 'ncat')
  AND NOT process.command_line LIKE '%/usr/local/bin/approved_worker%'
ORDER BY event.timestamp DESC;

SELECT
  source.ip,
  COUNT(*) AS total_failed_logons,
  COUNT(DISTINCT target.user.name) AS unique_targeted_accounts,
  MIN(event.timestamp) AS spray_start,
  MAX(event.timestamp) AS spray_end
FROM authentication_events
WHERE event.outcome = 'failure'
  AND event.category = 'cloud_identity'
  AND event.timestamp >= NOW() - INTERVAL '1 hour'
GROUP BY source.ip
HAVING total_failed_logons > 500 AND unique_targeted_accounts > 20
ORDER BY total_failed_logons DESC;

rule Enterprise_Gateway_Exploit_Tooling
{
    meta:
        author = "Inferlume CTI"
        date = "2026-10-23"
        description = "Detects script artifacts and strings associated with k0t and PHP2Shell exploitation"
        confidence = "high"

    strings:
        $s1 = "fortnew.py" ascii nocase
        $s2 = "exploit_2026_0257.py" ascii nocase
        $s3 = "aslr_exploit.py" ascii nocase
        $s4 = "the GlobalProtect login endpoint (login.esp)" ascii
        $s5 = "PHP_SESSION_UPLOAD_PROGRESS" ascii
        $s6 = "thunder.godofthunder.st" ascii

    condition:
        filesize < 5MB and 2 of ($s1, $s2, $s3, $s4, $s5, $s6)
}

rule Potassium_Botnet_ELF_Payload
{
    meta:
        author = "Inferlume CTI"
        date = "2026-10-23"
        description = "Detects Potassium botnet ELF binaries based on communication strings and flood markers"
        confidence = "medium-high"

    strings:
        $magic = { 7F 45 4C 46 }
        $c2 = "134.199.154.64" ascii
        $dom = "thunder.godofthunder.st" ascii
        $flood1 = "FLOOD_ICMP" ascii wide
        $flood2 = "FLOOD_OPENVPN" ascii wide

    condition:
        uint32(0) == 0x464C457F
        and filesize < 2MB
        and ($c2 or $dom)
        and 1 of ($flood1, $flood2)
}