Inferlume

title: AhsayCBS Core Service Spawning Suspicious Child Process
id: a87e14d2-43f1-482a-bc91-23f0198642a1
status: experimental
description: Detects AhsayCBS backup services cbssvcX64 or cbssvcX86 spawning command shells or download utilities indicative of CVE-2026-105134 exploitation.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\cbssvcX64.exe'
      - '\cbssvcX86.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Authorized administrative backup maintenance scripts
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.001

title: SonicWall SMA 1000 WorkPlace Loopback Probe Attempt
id: 3b1a7d62-9e23-424a-b50a-e5a96023d854
status: experimental
description: Detects HTTP OPTIONS requests directed at SMA 1000 WorkPlace extraweb endpoints targeting internal CouchDB daemons under CVE-2026-102255.
logsource:
  category: webserver
  product: sonicwall_sma
detection:
  selection_endpoint:
    cs-method: 'OPTIONS'
    cs-uri-stem|contains: '/workplace/extraweb'
  selection_payload:
    cs-uri-query|contains:
      - '127.0.0.1'
      - 'localhost'
      - '5984'
      - '_rewrite'
      - '_design'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Unlikely in production environments
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.discovery
  - attack.t1005

title: Renamed SoftEther VPN Client Execution
id: f421c908-1123-4e3b-9a41-89d1234098aa
status: experimental
description: Detects SoftEther VPN client execution disguised as common Windows binaries associated with Integrity Technology Group persistence.
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\conhost.exe'
      - '\dllhost.exe'
  selection_cli:
    CommandLine|contains:
      - 'vpnclient'
      - 'vpncmd'
      - 'SoftEther'
  condition: selection_image and selection_cli
falsepositives:
  - None expected in enterprise environments
level: high
tags:
  - attack.persistence
  - attack.t1133
  - attack.defense_evasion
  - attack.t1036.003

rule Exploit_CVE_2026_102255_SonicWall_CouchDB_Probe {
    meta:
        description = "Detects network payloads and memory traces attempting preauthentication SSRF against SonicWall SMA 1000 CouchDB"
        author = "Inferlume Threat Research"
        date = "2026-10-09"
        reference = "CVE-2026-102255"
        severity = "Critical"
    strings:
        $http_verb = "OPTIONS " ascii
        $endpoint = "/workplace/extraweb" ascii nocase
        $target_ip = "127.0.0.1:5984" ascii
        $rewrite_fn = "_rewrite" ascii
        $auth_token = "YWRtaW46YWRtaW4=" ascii
    condition:
        $http_verb at 0 and $endpoint and ($target_ip or $rewrite_fn or $auth_token)
}

rule Suspicious_AhsayCBS_Taskgmr_Evasion_Script {
    meta:
        description = "Detects PowerShell routines monitoring Taskmgr to halt and resume malicious Windows services"
        author = "Inferlume Threat Research"
        date = "2026-10-09"
        severity = "High"
    strings:
        $ps_proc = "Get-Process" ascii nocase
        $ps_taskmgr = "Taskmgr" ascii nocase
        $ps_stop = "Stop-Service" ascii nocase
        $ps_start = "Start-Service" ascii nocase
        $svc_target = "MicrosoftEdgeUpdateSvc" ascii nocase
    condition:
        all of them
}

index=web_proxy OR index=firewall sourcetype=sonicwall:sma
| where http_method="OPTIONS" AND like(uri_path, "%/workplace/extraweb%")
| eval is_loopback=if(match(uri_query, "(127\.0\.0\.1|localhost|5984|_rewrite)"), 1, 0)
| where is_loopback=1
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, uri_path, uri_query, http_user_agent

index=windows sourcetype=WinEventLog:Security EventCode=4662
| where match(Properties, "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2")
| eval is_dc=if(match(SubjectUserName, "\\$$"), 1, 0)
| where is_dc=0
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, SubjectUserName, ComputerName