Inferlume

CVE-2026-15409 & CVE-2026-15410: Edge Appliance Exploit — SonicWall SMA1000 Zero-Days

Detection Engineering Opportunities:

• Log-source coverage validation is critical. Defenders must verify that security appliances are routing local web application logs, operational subsystem logs, and configuration state records to central SIEM databases.

• Analysts can alert on unauthenticated HTTP requests targeted at configuration or workspace routines that return success responses, or websocket setups referencing unexpected third-party targets.

• System log parsers can flag anomalous operational processes executing recovery or hotfix management logic where path traversal strings are injected into local server routines.

Detection Context Quality:

• Data source requirements: Successful detection engineering relies on continuous collection of three primary local system files: extraweb_access.log, ctrl-service.log, and the directory configuration blueprint conf.json.

• Known detection gaps: External firewalls and network flow monitors cannot easily inspect encrypted SSL-VPN sessions terminating directly on the appliance. Internal threat hunting remains the primary route for detecting exploitation when standard intrusion prevention signatures fail.

Threat Hunting Hypotheses:

• Hypothesis: Threat actors are exploiting unauthenticated Server-Side Request Forgery vulnerabilities to use external secure gateways as local proxy systems to inventory or abuse internal operational servers.

• Evidence target: Analyze perimeter outbound connections originating from the SMA1000 cluster directed to internal assets or metadata management endpoints that are not part of routine administrative duties.

SIEM / EDR / Network Monitoring Signals:

• SIEM: Deploy direct log queries to match successful HTTP transactions targeted at authentication management endpoints or websocket gateways:

SELECT source_ip, requested_uri, response_status, host_header 
FROM firewall_web_logs 
WHERE platform = 'SonicWall SMA1000' 
  AND (
       (requested_uri IN ('/_api_/login', '/__api__/logout') AND response_status = 200) 
       OR 
       (requested_uri = '/wsproxy' AND response_status = 101)
      )

• EDR: Create real-time alerts within system management files for execution arguments containing directory traversal patterns associated with hotfix installation:

SELECT event_time, process_name, message 
FROM system_events 
WHERE log_source = 'ctrl-service' 
  AND message LIKE '%hotfix rollback%' 
  AND message LIKE '%..%'

• Network: Implement network alerts matching persistent, low-volume TCP connections initiated by external-facing remote access appliances that attempt connections to internal network segments.

CVE-2026-56164: Missing Authentication check — SharePoint Server Missing Authentication

Detection Engineering Opportunities:

• Monitor local web server access logs for incoming connection requests aimed at privileged administrative components that lack valid user authentication tokens.

• Match IIS server records where requests to sensitive backend functions occur outside of normal site administrative patterns.

Detection Context Quality:

• Data source requirements: Requires IIS application logs, SharePoint Unified Logging System trace diagnostics, and Active Directory authentication event records.

• Known detection gaps: Attackers executing commands within legitimate, unauthenticated pathways can mask malicious transactions as routine web errors, making standard signature detection difficult.

Threat Hunting Hypotheses:

• Hypothesis: Attackers are bypassing authentication checks on exposed on-premises SharePoint portals to retrieve critical configuration variables or initiate backend modifications.

• Evidence target: Hunt for unrecognized, unauthenticated web requests directed at server configuration pathways that are immediately followed by privilege escalation events or token anomalies.

SIEM / EDR / Network Monitoring Signals:

• SIEM: Query web access databases to isolate unauthenticated connections directed to critical portal directories returning success codes:

SELECT client_ip, request_uri, http_status_code 
FROM iis_web_logs 
WHERE server_role = 'SharePoint' 
  AND user_identity IS NULL 
  AND request_uri LIKE '%_layouts/15/%' 
  AND http_status_code = 200

• EDR: Monitor local web service helper systems for unusual process execution requests, including command utility spawns originating from web server worker files.

• Network: Inspect internal network records for unusual web commands or unexpected data transfers originating from unpatched document management portals.

CVE-2026-56155: Access Control Abuse — AD FS DKM ACL Hardening

Detection Engineering Opportunities:

• Alert on read or write requests to Active Directory Distributed Key Manager containers made by service accounts or local logins outside of default cluster setups.

• Audit modifications made to AD FS security keys or changes in local access policies.

Detection Context Quality:

• Data source requirements: Active Directory auditing must be enabled for container objects, combined with local event logs tracking AD FS configuration modifications.

• Known detection gaps: If auditing is not enabled on Active Directory schema objects, queries targeting symmetric keys in DKM containers will not generate alerts.

Threat Hunting Hypotheses:

• Hypothesis: Adversaries are querying AD FS DKM containers to read identity certificates and bypass single sign-on boundaries.

• Evidence target: Review log events tracking container permission changes or administrative AD FS service adjustments.

SIEM / EDR / Network Monitoring Signals:

• SIEM: Configure alerting systems to trace events monitoring permission assessment and remediation tasks:

SELECT EventID, User, TargetObject, NewValue 
FROM active_directory_logs 
WHERE LogName = 'AD FS/Admin' 
  AND EventID IN (1132, 1135)

• EDR: Monitor Windows registry query events looking for access to keys controlling AD FS container permission management.

• Network: [INSUFFICIENT SOURCE DATA] — network activity is not a viable indicator for this local privilege escalation vulnerability.

Action-Oriented Implementation Tasks

• Do this NOW: Configure local alert rules within SIEM engines targeting specific endpoints associated with the SMA1000 zero-day campaign.

• Hunt this week: Execute broad audits across all AD FS servers to check DKM container permissions and identify Event ID 1132 errors indicating insecure setups.