Inferlume

title: GitLab CI Configuration With High-Risk Regular Expression
id: 6f2a91c4_0000_4d1e_9a10_gitlab97229
status: experimental
description: >
  Detects suspicious recursive regular expression patterns within GitLab CI
  configuration files that may indicate exploitation of CVE-2026-97229.
logsource:
  product: gitlab
  service: audit
detection:
  selection_event:
    event_action:
      - 'pipeline_created'
      - 'pipeline_updated'
      - 'ci_config_updated'
  selection_regex:
    ci_config_content|contains|any:
      - '(?{'
      - '(?&'
      - '(?R'
      - '(?<'
      - '(?>'
      - '.{256,}'
  condition: selection_event and selection_regex
falsepositives:
  - Legitimate complex CI linting expressions
level: high

title: GitLab Worker Crash Following CI Configuration Update
id: replace_with_generated_uuid
status: experimental
description: >
  Correlates CI/CD configuration modifications with subsequent GitLab worker process
  crashes reflecting the observed Alpine Linux exploitation attempt pattern.
logsource:
  product: gitlab
  service: application
detection:
  selection_config:
    event_action:
      - 'ci_config_updated'
      - 'pipeline_created'
  selection_crash:
    event_action:
      - 'worker_crash'
      - 'service_terminated'
    process_name:
      - 'gitlab-worker'
      - 'sidekiq'
      - 'puma'
  timeframe: 15m
  condition: selection_config | near selection_crash
falsepositives:
  - Unrelated memory exhaustion or host reboot
level: critical

title: Possible Cisco ASA FTD SSL VPN Denial of Service
id: 8b7d23e1_0000_4f6a_91ab_cisco76418
status: experimental
description: >
  Correlates Remote Access SSL VPN connection attempts with sudden firewall reloads
  or NULL pointer dereference crashes indicating exploitation of CVE-2026-76418.
logsource:
  product: cisco
  service: firewall
detection:
  selection_vpn:
    event_category: 'vpn'
    vpn_service: 'sslvpn'
    tunnel_group_secondary_auth: true
  selection_reload:
    event_action:
      - 'device_reload'
      - 'unexpected_reload'
      - 'crash'
  timeframe: 5m
  condition: selection_vpn | near selection_reload
falsepositives:
  - Planned maintenance reboots
level: high

title: PAM su Configuration Modified by Non Package Process
id: 7c1e0b52_0000_4000_8000_inferlume001
status: experimental
description: >
  Detects modifications to /etc/pam.d/su originating from non package management
  binaries indicating potential Fragnesia CVE-2026-46300 privilege escalation.
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename: '/etc/pam.d/su'
  filter_pkg:
    Image|endswith:
      - '/dpkg'
      - '/rpm'
      - '/apt'
      - '/yum'
      - '/dnf'
      - '/ansible-playbook'
  condition: selection and not filter_pkg
falsepositives:
  - Legitimate custom administrative PAM adjustments
level: critical

title: Web Server Worker Spawning Interactive Shell or Recon Tools
status: experimental
description: >
  Detects web server daemons spawning interactive shells or reconnaissance tools
  indicative of unauthenticated remote code execution.
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/httpd'
      - '/apache2'
      - '/php-cgi'
      - '/appweb'
      - '/puma'
      - '/sidekiq'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/id'
      - '/whoami'
      - '/uname'
      - '/curl'
      - '/wget'
      - '/ssh'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate custom web application build scripts
level: high

rule PHP_Small_Webshell_Generic
{
  meta:
    description = "Detects compact PHP files executing request parameters via system execution functions"
    author = "Inferlume CTI"
    date = "2026-10-30"
    confidence = "medium"
  strings:
    $php = "<?php" nocase
    $exec = /(system|exec|passthru|shell_exec|popen|proc_open)\s*\(/ nocase
    $input = /\$_(GET|POST|REQUEST|COOKIE|SERVER)\s*\[/
  condition:
    filesize < 512 and $php at 0 and $exec and $input
}

# Query A: GitLab Unauthenticated CI Configuration Modification Followed by Shell Spawn
IF gitlab.audit.event IN ("pipeline_created", "ci_config_updated")
AND gitlab.user.authenticated = false
AND gitlab.ci_config.content MATCHES "(\\(\\?R|\\(\\?&|\\(\\?<|\\(\\?>|.{256,})"
FOLLOWED_WITHIN 15m ON SAME host BY
process.parent.name IN ("gitlab", "ruby", "bundle", "puma")
AND process.name IN ("sh", "bash", "python", "perl", "curl", "wget")
THEN RAISE CRITICAL ALERT "Confirmed GitLab CVE-2026-97229 RCE"

# Query B: Cisco Secure Firewall SSL VPN Reload Correlation
IF cisco.event_category = "vpn"
AND cisco.vpn_service = "sslvpn"
AND cisco.tunnel_group.secondary_auth = true
FOLLOWED_WITHIN 5m ON SAME device BY
cisco.event_action IN ("device_reload", "unexpected_reload", "system_crash")
THEN RAISE HIGH ALERT "Suspected Cisco CVE-2026-76418 DoS Exploitation"

# Query C: Drupal Commerce Unauthenticated Order Entity Manipulation
IF web.request.method IN ("POST", "PUT", "PATCH")
AND web.request.url CONTAINS_ANY ("/commerce", "/checkout", "/order")
AND web.user.authenticated = false
AND web.response.status_code NOT IN (401, 403)
FOLLOWED_WITHIN 1h ON SAME client_ip BY
commerce.order.status_changed = true
AND (commerce.order.total_amount = 0 OR commerce.payment.verified = false)
THEN RAISE HIGH ALERT "Suspected Drupal Commerce CVE-2026-118539 Fraud"

# Query D: Web Server Daemon Fragnesia Privilege Escalation to Root
IF process.parent.name IN ("appweb", "php-fpm", "httpd", "apache2")
AND process.name = "su"
AND process.user = "nobody"
AND process.command_line CONTAINS "root"
AND authentication.outcome = "success"
THEN RAISE CRITICAL ALERT "Privilege Escalation via Fragnesia pam_permit"