Inferlume

title: Cisco Secure Firewall Management Center CVE-2026-20079 Authentication Bypass Attempt
id: 7c8a9f2e-4d1b-4e8a-9f3c-2a1b6d7e8f9a
status: test
description: Detects exploitation attempts for CVE-2026-20079 (CVSS 10.0) authentication bypass in Cisco FMC API endpoint exploited by Sandworm (APT28) and Qilin ransomware.
author: NightWatch
date: 2026-09-27
logsource:
  category: webserver
  product: cisco_fmc
detection:
  selection:
    cs_uri_stem|contains: '/api/fmc_platform/v1/'
    c_http_method: 'POST'
    cs_uri_query|contains|all:
      - 'bypass'
      - 'auth'
  condition: selection
fields:
  - c_ip
  - cs_uri_stem
  - cs_uri_query
  - c_http_method
  - sc_status
falsepositives:
  - Legitimate API testing tools
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.20079

title: LiteLLM Default Master Key (sk-1234) Authentication Success
id: 9f2e1d4a-7b3c-4a5e-8f1d-2c3b4a5d6e7f
status: test
description: Detects successful authentication to LiteLLM gateway using the documented default master key sk-1234.
author: NightWatch
date: 2026-09-27
logsource:
  category: proxy
  product: litellm
detection:
  selection:
    request_headers:
      Authorization: 'Bearer sk-1234'
    response_status: 200
  condition: selection
fields:
  - src_ip
  - dest_ip
  - request_headers
  - response_status
  - request_body
falsepositives:
  - Non production testing with default key
level: high
tags:
  - attack.initial_access
  - attack.t1078.001
  - attack.credential_access

title: JFrog Artifactory Authentication Bypass Chain Exploitation Attempt
id: a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d
status: test
description: Detects chained exploitation of CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 leading to unauthenticated admin takeover.
author: NightWatch
date: 2026-09-27
logsource:
  category: webserver
  product: jfrog_artifactory
detection:
  selection_anon_token:
    cs_uri_stem|endswith: '/api/security/anonymous'
    c_http_method: 'GET'
    sc_status: 200
  selection_jwt_forge:
    cs_uri_stem|contains: '/api/auth/'
    c_http_method: 'POST'
    request_body|contains: 'admin'
    request_body|contains: 'token'
  selection_admin_action:
    cs_uri_stem|contains|all:
      - '/api/'
      - 'admin'
    c_http_method|in: ['POST', 'PUT', 'DELETE']
    sc_status: 200
  condition: 1 of selection_* AND (selection_anon_token OR selection_jwt_forge)
fields:
  - c_ip
  - cs_uri_stem
  - c_http_method
  - sc_status
  - request_body
  - cs_user_agent
falsepositives:
  - Legitimate admin API usage
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.privilege_escalation

title: NTDSUtil IFM-Style Credential Staging
id: 7c2a9e14-6b0d-4f3a-9c11-ntds-ifm-week
status: experimental
description: Detects ntdsutil creating an IFM copy consistent with Storm-2570 credential dumping.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\ntdsutil.exe'
    CommandLine|contains|all:
      - 'ifm'
      - 'create full'
  condition: selection
level: high
falsepositives:
  - Authorized domain controller IFM backups

title: S5cmd or Rclone Launched Outside Admin Change Window
id: 91de4402-s5cmd-rclone-week
status: experimental
description: Detects s5cmd and Rclone execution observed in Storm-2570 S3 compatible exfiltration.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\s5cmd.exe'
      - '\rclone.exe'
  condition: selection
level: medium

title: Suspicious Encoded PeopleSoft EMHub Access
id: 7bffde37-8fc6-4d6a-a2bd-people-soft-001
status: experimental
description: Detects requests targeting PeopleSoft EMHub through percent encoded or normalized path variants.
logsource:
  category: webserver
detection:
  selection_path:
    url|re: '(?i)(%25?50|%70|p)[sS][eE][mM][hH][uU][bB]'
  selection_endpoint:
    url|contains:
      - '/hub'
      - 'PSEMHUB'
  selection_method:
    http_method:
      - POST
  condition: selection_path and selection_endpoint and selection_method
fields:
  - src_ip
  - user_agent
  - url
  - http_method
  - status
  - response_size
falsepositives:
  - Authorized PeopleSoft administration
level: high
tags:
  - attack.initial-access
  - attack.t1190

title: WebLogic Spawns Command Shell on PeopleSoft Host
id: 46a0a7ec-2a06-4ae2-9f9a-weblogic-shell-002
status: experimental
description: Detects shell processes created by a WebLogic or Java application process.
logsource:
  category: process_creation
detection:
  parent:
    ParentImage|endswith:
      - '/java'
      - '/java.exe'
      - '/weblogic'
      - '\java.exe'
  child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '\cmd.exe'
      - '\powershell.exe'
  condition: parent and child
fields:
  - ParentImage
  - Image
  - CommandLine
  - User
  - Host
falsepositives:
  - Approved application maintenance scripts
level: high
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059.004

title: Unexpected JSP or Executable in PeopleSoft PSEMHUB Archive
id: 1190df46-7a72-4fa1-8f62-peoplesoft-file-003
status: experimental
description: Detects creation of suspicious JSP, JSPX, or executable files under PeopleSoft web application archives.
logsource:
  category: file_event
detection:
  selection_path:
    TargetFilename|re: '(?i)(PSEMHUB\.war|PORTAL\.war).*\.(jsp|jspx|exe)$'
  selection_name:
    TargetFilename|endswith:
      - '/x.jsp'
      - '/u.jsp'
      - '/u2.jsp'
      - '/tunnel.jsp'
      - '/tunnel.jspx'
      - '/Ple64.exe'
  condition: selection_path or selection_name
fields:
  - TargetFilename
  - Image
  - User
  - ProcessCommandLine
level: high
tags:
  - attack.persistence
  - attack.t1505.003

title: Azure Service Principal Destructive Resource Activity
id: 6e259ff8-cd80-43e8-8b5c-azure-destroy-004
status: experimental
description: Detects burst destructive operations and storage key retrieval by a workload identity.
logsource:
  product: azure
  service: activitylogs
detection:
  identity:
    caller|contains:
      - 'serviceprincipal'
      - 'appId'
  destructive:
    operationName|contains:
      - 'delete'
      - 'Delete'
      - 'listKeys'
      - 'ListKeys'
  sensitive_resources:
    resourceType|contains:
      - 'storageAccounts'
      - 'vaults'
      - 'recoveryServicesVaults'
      - 'managed databases'
      - 'serverfarms'
      - 'sites'
  condition: identity and destructive and sensitive_resources
fields:
  - caller
  - callerIpAddress
  - operationName
  - resourceGroup
  - resourceId
  - correlationId
level: critical
tags:
  - attack.impact
  - attack.t1485
  - attack.t1490
  - attack.credential-access

title: Suspicious Outbound Connection From F5 BIG-IP Management Or Data Plane
id: 6e4b6a7f-2e6f-4f24-9e15-f5bigip2026
status: experimental
description: Detects unexpected outbound connections initiated by F5 BIG-IP systems following exploitation of CVE-2026-94127.
logsource:
  category: firewall
detection:
  selection:
    src_ip|cidr:
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
    device_vendor: F5
    action: allowed
  filter_expected:
    dst_port:
      - 443
      - 53
  condition: selection and not filter_expected
level: high
falsepositives:
  - Approved administration or monitoring traffic
tags:
  - attack.initial-access
  - attack.t1190

title: External Access To Docker API
id: 2bf1f4d6-5f2c-42dc-9f0c-docker-api
status: experimental
description: Detects inbound access to Docker API ports from untrusted networks.
logsource:
  category: firewall
detection:
  selection:
    dst_port:
      - 2375
      - 2376
    action: allowed
  filter_internal:
    src_ip|cidr:
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
  condition: selection and not filter_internal
level: critical
tags:
  - attack.initial-access
  - attack.t1190

title: Suspected Web Application Exploitation Followed By Shell Execution
status: experimental
logsource:
  category: webserver
detection:
  selection_request:
    http_method:
      - POST
      - PUT
    url_query|contains:
      - "../"
      - "%2e%2e"
      - "UNION SELECT"
      - "cmd="
      - "powershell"
      - "Runtime.getRuntime"
  selection_exec:
    process_command_line|contains:
      - "curl "
      - "wget "
      - "bash -c"
      - "powershell"
      - "chmod +x"
  condition: selection_request and selection_exec
fields:
  - src_ip
  - url
  - user_agent
  - process_command_line
falsepositives:
  - Authorized penetration testing
level: high

title: Suspicious macOS Launch Agent Creation (ROOFDECK-style)
id: e2f7a9c1-3d4b-4e8f-9a1c-7b6d5e4f3a2b
status: experimental
description: Detects creation of LaunchAgent plists in user or system library directories used for persistence by macOS backdoors.
author: NightWatch CTI
date: 2026/09/27
logsource:
    category: file_event
    product: macos
detection:
    selection:
        TargetFilename|contains:
            - '/Library/LaunchAgents/'
            - '~/Library/LaunchAgents/'
        TargetFilename|endswith: '.plist'
    condition: selection
falsepositives:
    - Legitimate software installers
level: medium
tags:
    - attack.persistence
    - attack.t1543.001

title: Suspicious AI Provider Access With Credential Theft Behaviors
status: experimental
logsource:
  category: process_creation
detection:
  ai_provider:
    destination_domain|contains:
      - "api.deepseek.com"
      - "api.mistral.ai"
      - "generativelanguage.googleapis.com"
      - "openrouter.ai"
  suspicious_process:
    Image|endswith:
      - ".exe"
  credential_or_injection:
    CommandLine|contains:
      - "MiniDumpWriteDump"
      - "lsass"
      - "NtQueueApcThread"
      - "schtasks"
      - "wmi"
  condition: ai_provider and suspicious_process and credential_or_injection
level: high
falsepositives:
  - Approved developer or security tooling with documented AI integrations

rule MacSync_Stealer_Backdoor_2026_09 {
    meta:
        author = "NightWatch"
        date = "2026-09-27"
        description = "Detects MacSync macOS infostealer and backdoor variant with new infection chain, backdoor module, and crypto wallet targeting."
        tlp = "amber"
    strings:
        $macho = { CF FA ED FE ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 0C }
        $backdoor_str = "backdoor" ascii wide nocase
        $c2_pattern = /https?:\/\/[a-zA-Z0-9.-]+\.(com|net|io|xyz)\/api\/v[0-9]+\/command/ ascii
        $keychain = "SecItemCopyMatching" ascii
        $crypto_wallet = /(Bitcoin|Ethereum|MetaMask|Phantom|Exodus|Ledger|Trezor)/ ascii nocase
        $clickfix = "ClickFix" ascii nocase
        $osascript_spawn = "osascript" ascii
        $base64_decode = "base64 -d" ascii
    condition:
        $macho at 0 and
        (any of ($backdoor_str, $c2_pattern, $keychain, $crypto_wallet, $clickfix, $osascript_spawn, $base64_decode))
}

rule NightWatch_Storm2570_RMM_Staging_Strings
{
  meta:
    description = "String hunt for MeshAgent, MeshCentral, and Cloudflare tunnel binaries in Storm-2570 operations."
    author = "NightWatch"
  strings:
    $m1 = "MeshAgent" ascii wide nocase
    $m2 = "MeshCentral" ascii wide nocase
    $c1 = "cloudflared" ascii wide nocase
    $t1 = "--token" ascii wide
  condition:
    uint16(0) == 0x5A4D and (2 of ($m*)) or ($c1 and $t1)
}

rule Suspicious_Ple64_SIDEEYE_Triage
{
    meta:
        description = "Triage rule for Ple64.exe and SIDEEYE sample characteristics"
        confidence = "medium"
    strings:
        $name = "Ple64.exe" ascii wide nocase
        $light_alloy = "Light Alloy" ascii wide nocase
        $vmprotect = "VMProtect" ascii wide nocase
        $tcp3333 = ":3333" ascii wide
        $tcp3334 = ":3334" ascii wide
    condition:
        uint16(0) == 0x5a4d and
        2 of ($name, $light_alloy, $vmprotect, $tcp3333, $tcp3334)
}

rule Suspicious_ClickFix_PowerShell_Command
{
    meta:
        description = "Detects common PowerShell execution patterns associated with fake verification workflows"
        confidence = "medium"
    strings:
        $ps1 = "powershell" nocase
        $enc = "-enc" nocase
        $iex = "iex" nocase
        $download = "Invoke-WebRequest" nocase
        $download2 = "Net.WebClient" nocase
        $from_clip = "Get-Clipboard" nocase
    condition:
        2 of ($ps1, $enc, $iex, $download, $download2, $from_clip)
}

rule Suspicious_Developer_Token_Collection
{
    meta:
        description = "Detects strings associated with browser, CI/CD, and developer token collection"
        confidence = "low_to_medium"
    strings:
        $browser_store = /Login Data|Cookies|Web Data/i
        $ci_secret = /GITHUB_TOKEN|NPM_TOKEN|CI_JOB_TOKEN|AWS_SECRET_ACCESS_KEY/i
        $discord = /discord(app)?\.com\/api/i
        $wallet = /wallet|metamask|exodus|phantom/i
        $archive = /7z a|zip -r|tar -czf/i
    condition:
        2 of ($browser_store, $ci_secret, $discord, $wallet, $archive)
}

rule MacOS_FLATROOF_ROOFDECK_Heuristics {
    meta:
        description = "Heuristic YARA rule for Rust based macOS backdoors with Telegram and Nostr C2 patterns"
        author = "NightWatch CTI"
        date = "2026-09-27"
    strings:
        $s1 = "Telegram" ascii
        $s2 = "Nostr" ascii
        $s3 = "LaunchAgents" ascii
        $s4 = "login.keychain-db" ascii
        $rust1 = "_RNvCs" ascii
        $rust2 = "_RINvNtNtCs" ascii
    condition:
        2 of ($s*) and 1 of ($rust*)
}

rule Suspicious_LLM_Orchestrated_Windows_Implant
{
    meta:
        description = "Behavioral and string anchors for an LLM orchestrated credential theft implant"
        confidence = "medium"
    strings:
        $prompt = "advanced malware strategist" ascii nocase
        $decision = "\"inject\"" ascii
        $decision2 = "\"persist\"" ascii
        $decision3 = "\"steal\"" ascii
        $lsass = "MiniDumpWriteDump" ascii
        $discord = "discord.com/api/webhooks" ascii nocase
        $deepseek = "api.deepseek.com" ascii nocase
        $mistral = "api.mistral.ai" ascii nocase
        $gemini = "generativelanguage.googleapis.com" ascii nocase
        $schtasks = "schtasks.exe" ascii nocase
    condition:
        uint16(0) == 0x5A4D and
        3 of ($decision*) and
        2 of ($lsass, $discord, $deepseek, $mistral, $gemini, $schtasks)
}

let Storm2570_Tools = dynamic([
    "mimikatz", "sekurlsa", "lsadump", "procdump", "comsvcs.dll",
    "rubeus", "asktgt", "asktgs", "kerberoast",
    "bloodhound", "sharphound", "adfind",
    "psexec", "wmiexec", "smbexec", "atexec",
    "schtasks", "at.exe", "sc create", "service install",
    "cobaltstrike", "beacon", "meterpreter",
    "Invoke-Mimikatz", "Invoke-Kerberoast", "Invoke-DCSync"
]);
SecurityEvent
| where EventID in (4688, 4624, 4672, 4673, 5145, 5140)
| where ProcessCommandLine has_any (Storm2570_Tools)
| or where TargetLogonType == 3 and TargetUserName !endswith "$"
| extend ToolMatched = extract_all(ProcessCommandLine, Storm2570_Tools)
| where array_length(ToolMatched) > 0
| summarize EventCount=count(), ToolSet=make_set(ToolMatched), TimeRange=min(TimeGenerated)..max(TimeGenerated) by Computer, Account, ProcessName
| where EventCount >= 3
| project Computer, Account, ProcessName, ToolSet, EventCount, TimeRange
| sort by EventCount desc

AzureActivity
| where TimeGenerated > ago(7d)
| where Caller contains "app@" or Caller contains "sp@" or Caller contains "ServicePrincipal" or CallerType == "ServicePrincipal"
| where OperationNameValue has_any (
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.Resources/deployments/delete",
    "Microsoft.KeyVault/vaults/secrets/read",
    "Microsoft.KeyVault/vaults/delete",
    "Microsoft.Storage/storageAccounts/delete",
    "Microsoft.Storage/storageAccounts/listKeys/action",
    "Microsoft.Web/sites/delete",
    "Microsoft.RecoveryServices/vaults/delete",
    "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/delete",
    "Microsoft.Resources/locks/delete",
    "Microsoft.Authorization/roleAssignments/write",
    "Microsoft.Compute/virtualMachines/extensions/write",
    "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action"
)
| summarize
    Operations=count(),
    OperationTypes=make_set(OperationNameValue),
    Resources=dcount(ResourceId),
    IPs=make_set(CallerIpAddress),
    TimeRange=min(TimeGenerated)..max(TimeGenerated)
  by Caller, SubscriptionId, bin(TimeGenerated, 2h)
| where (Operations >= 5 and Resources >= 3) or (OperationTypes has "delete" and OperationTypes has "listKeys")
| project Caller, SubscriptionId, Operations, Resources, OperationTypes, IPs, TimeRange

sign_in
| where auth_protocol has "deviceCode" or authentication_protocol == "deviceCodeFlow"
| where result == "success"
| join kind=inner (
    audit
    | where operation in ("New-InboxRule", "Set-InboxRule",
                          "Add member to role",
                          "Register device", "Add registered owner")
  ) on user_id
| where audit.event_time between (sign_in.event_time .. sign_in.event_time + 6h)
| project user_id, sign_in.event_time, sign_in.source_ip,
          sign_in.app_display_name, audit.operation, audit.event_time

index=web OR index=proxy
(
  uri_path="*PSEMHUB*" OR
  uri_path="*%50SEMHUB*" OR
  uri_path="*%2fPSEMHUB*" OR
  uri_path="*%2550SEMHUB*"
)
AND (
  uri_path="*/hub*" OR
  http_method="POST"
)
| stats count min(_time) as first_seen max(_time) as last_seen
  values(src_ip) as src_ip
  values(http_user_agent) as user_agent
  values(status) as status
  by dest, uri_path
| where count >= 3

index=network sourcetype=syslog host=* 
| search "sshd" AND "rekey" AND "authenticated=no" 
| stats count by src_ip, dest_ip, dest_port 
| where count > 5 
| eval note="Possible MikroTrick SSH rekey bypass attempt"

index=webproxy OR index=firewall 
| search "BIG-IP" AND "OAuth" AND "Authorization" 
| regex "Authorization:\s*[A-Za-z0-9+/=]{500,}" 
| eval note="Oversized Authorization header to BIG-IP APM OAuth endpoint"

FROM network_logs
WHERE destination_asset IN (
  "F5_BIGIP",
  "CHECK_POINT_SECURITY_GATEWAY",
  "WSO2",
  "SHAREPOINT",
  "PEOPLESOFT",
  "ROUNDCUBE",
  "TEAMCITY",
  "NETSCALER",
  "ARISTA_VELOCLOUD",
  "CISCO_FMC"
)
AND (
  http_status IN (200, 201, 204, 500)
  OR process_created = true
  OR outbound_connection_after_request = true
)
AND event_time BETWEEN exploit_disclosure_time AND patch_validation_time
GROUP BY source_ip, destination_asset, user_agent, uri, 15m
HAVING count(*) >= 5
   OR distinct_uri_count >= 3
   OR outbound_connection_after_request = true

FROM github_audit_logs_and_process_events
WHERE (
  event_type IN ("workflow.modified", "workflow.enabled", "repository_action.updated", "release.created")
  AND (actor_is_new = true OR action_ref_changed = true OR workflow_permissions INCLUDES "write-all" OR workflow_executes_unpinned_reference = true)
)
OR (
  (command_line CONTAINS "actions/" OR command_line CONTAINS "npm install" OR command_line CONTAINS "curl ")
  AND (secret_access = true OR file_read_path MATCHES "*github*credentials*" OR file_read_path MATCHES "*npmrc" OR outbound_domain IS_NEW_FOR_WORKFLOW = true)
  AND workflow_action_ref NOT IN approved_signed_action_refs
)
ALERT severity = "high"

FROM endpoint_network_process_events
WHERE process_is_executable = true
  AND destination_domain IN (
      "api.deepseek.com",
      "api.mistral.ai",
      "generativelanguage.googleapis.com",
      "openrouter.ai"
  )
GROUP BY host_id, process_hash, process_name WITHIN 15 minutes
HAVING COUNT_DISTINCT(destination_domain) >= 2
   AND (
       EXISTS process_access WHERE target_process = "lsass.exe"
       OR EXISTS injection_event WHERE technique IN ("APC", "process_hollowing")
       OR EXISTS persistence_event WHERE type IN ("RunKey", "ScheduledTask", "WMI")
       OR EXISTS network_event WHERE destination_domain LIKE "%discord%"
   )
ALERT "High confidence suspicious AI orchestrated malware behavior"

FROM web_server_file_events
WHERE event_time >= patch_or_disclosure_time
  AND file_path IN web_application_root
  AND (
      file_extension IN (".aspx", ".ashx", ".asmx", ".config", ".jsp", ".jspx")
      OR file_name MATCHES "(shell|upload|cmd|debug|tmp)"
  )
  AND creator_process NOT IN approved_web_server_processes
RETURN host, user, file_path, hash, parent_process, first_seen