Inferlume

title: Ivanti Connect Secure CVE-2026-104935 Exploit Header Detection
id: b92a81f3-4c11-4a29-9e84-1d7f35b2e001
status: experimental
description: Detects inbound HTTP requests containing the anomalous X-DSCGI-PATH header targeted at Ivanti Connect Secure gateways.
logsource:
  category: webserver
  product: ivanti_connect_secure
detection:
  selection_header:
    cs_headers|contains: 'X-DSCGI-PATH'
  selection_uri:
    cs_uri_stem|contains: '/dana-na/auth/url_default/welcome.cgi'
  selection_internal:
    cs_headers|contains:
      - '/home/webserver/htdocs/dana/fb/smb/wu.cgi'
      - '/home/runtime/tmp/'
  condition: selection_header and (selection_uri or selection_internal)
falsepositives:
  - Unknown administrative tools utilizing non standard headers
level: critical
tags:
  - attack.initial_access
  - attack.t1190

title: BeyondTrust Remote Support Suspicious File and Permission Activity
id: 5e1a74d2-9b22-4c81-8a33-2f8c41d6b002
status: experimental
description: Detects suspicious file uploads, SUID permission changes, or log tampering on BeyondTrust appliances.
logsource:
  product: beyondtrust_remote_support
  service: appliance
detection:
  selection_upload:
    event_category: file_operation
    action:
      - upload
      - write
    file_path|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/opt/beyondtrust/'
      - '/appliance/'
  selection_suid:
    event_category: process_execution
    process_name|endswith: 'chmod'
    command_line|contains: 'u+s'
  selection_logs:
    event_category: file_operation
    action:
      - delete
      - truncate
    file_path|contains:
      - '/var/log/'
      - 'syslog'
      - 'audit.log'
  condition: 1 of selection_*
falsepositives:
  - Authorized vendor maintenance procedures
level: critical
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1222
  - attack.t1505.003

title: AhsayCBS Service Spawning Command Interpreter
id: f3d891b4-2e11-4890-8c22-3a7e55b1d003
status: experimental
description: Detects AhsayCBS Java processes spawning system shells or script engines indicative of CVE-2026-105134 exploitation.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\AhsayCBS.exe'
    ParentCommandLine|contains: 'cbs'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative backup maintenance tasks
level: critical
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003

rule Hunt_ArmoryCastle_SAWFLY_BARECLAW_Artifacts
{
    meta:
        author = "Antigravity CTI"
        date = "2026/10/16"
        description = "Memory and disk hunt rule for reported Armory Castle SAWFLY webshell and BARECLAW tunneler artifacts"
        reference = "Consulted Intelligence Telemetry"
        confidence = "medium"

    strings:
        $s1 = "SAWFLY" ascii wide nocase
        $s2 = "BARECLAW" ascii wide nocase
        $w1 = "eval(" ascii wide
        $w2 = "base64_decode(" ascii wide
        $w3 = "shell_exec(" ascii wide
        $t1 = "CONNECT " ascii wide
        $t2 = "SOCKS5" ascii wide

    condition:
        uint16(0) == 0x5a4d and
        (
            (any of ($s*)) or
            (1 of ($w*) and 1 of ($t*))
        )
}

RULE Correlation_Multi_Gateway_Exploitation:
  WHEN
    (
      (
        log_source = "ivanti_connect_secure"
        AND http_header_names CONTAINS "X-DSCGI-PATH"
      )
      OR
      (
        log_source = "beyondtrust_remote_support"
        AND (process_commandline MATCHES "chmod.*u\\+s" OR file_path MATCHES ".*sawfly.*")
      )
      OR
      (
        log_source = "atlassian_data_center"
        AND http_method = "GET"
        AND http_status_code = 200
        AND uri_path MATCHES ".*(database\\.properties|dbconfig\\.xml|\\.env|credentials).*"
      )
      OR
      (
        log_source = "ahsaycbs"
        AND (
          destination_ip IN ["38.60.252.110", "13.143.164.15", "45.142.141.160", "74.208.22.238", "167.148.88.236"]
          OR uri_stem MATCHES ".*UpdateReceivers\\.do.*"
        )
      )
      OR
      (
        log_source = "cisco_secure_email_gateway"
        AND log_message CONTAINS "System Security: Suspected compromise indicator was found"
      )
    )
  THEN
    TRIGGER_ALERT(
      title = "Critical Infrastructure Gateway Exploitation Event",
      severity = "CRITICAL",
      enrich_fields = ["source_ip", "destination_ip", "user_identity", "process_lineage"],
      action = "EXECUTE_IMMEDIATE_ISOLATION_PLAYBOOK"
    )