Inferlume

// YARA pseudocode: Detect Serv-U CVE-2026-28318 exploit attempt artifacts
// Triggers on HTTP POST artifacts containing deflate-encoded payloads
// targeting Serv-U default management port patterns

rule Detect_SolarWinds_ServU_CVE_2026_28318 {
    meta:
        description = "Detects suspicious POST requests targeting SolarWinds Serv-U DoS flaw"
        cve = "CVE-2026-28318"
        severity = "HIGH"
        author = "NightWatch CTI"
    strings:
        // Serv-U management portal URI patterns
        $uri1 = "/Web%20Client/" nocase ascii
        $uri2 = "/api/" nocase ascii
        // Deflate encoding header abuse - core of the exploit
        $header1 = "Content-Encoding: deflate" nocase ascii
        $header2 = "Content-Encoding:deflate" nocase ascii
        // POST method indicator
        $method = "POST " ascii
    condition:
        $method and
        ($uri1 or $uri2) and
        ($header1 or $header2)
}

# SIGMA pseudocode: Detect anomalous credential reset patterns
# consistent with ShinyHunters-style vishing help desk exploitation
# Maps to MITRE T1566.004 and T1078

title: Anomalous Help Desk Credential Reset - Vishing Indicator
status: experimental
description: |
  Detects rapid or bulk credential resets initiated by help desk
  accounts outside normal business hours or from unusual source IPs,
  consistent with vishing-led account takeover (ShinyHunters TTP).
logsource:
    category: identity_management    product: generic  # Applies to Active Directory, Entra ID, Okta, etc.
detection:
    selection:
        EventType: "PasswordReset"        InitiatedBy|contains: "helpdesk"  # Adjust to match your help desk role naming
    filter_normal_hours:
        # Flag resets outside Mon-Fri 08:00-18:00 local time
        HourOfDay|gte: 18        HourOfDay|lte: 8    timeframe: 1h
    condition: selection and filter_normal_hours | count() > 3
falsepositives:
    - Legitimate after-hours IT support during incidents
    - Batch onboarding operations
level: medium
tags:
    - attack.t1566.004    - attack.t1078

# SIGMA pseudocode: Detect cross-origin POST requests to Langflow refresh token endpoints
# indicative of CVE-2025-34291 exploitation chain (MuddyWater)

title: Langflow CORS-Based Token Theft Attempt (CVE-2025-34291)
id: a3f7b921-cc14-4e11-b6d5-f82a09c14e77
status: experimental
description: Detects cross-origin POST requests to Langflow refresh token endpoints indicative of CVE-2025-34291 exploitation chain.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-34291
author: NightWatch CTI
date: 2026-06-07
tags:
  - attack.initial_access  - attack.t1190  - attack.credential_access  - attack.t1539
logsource:
  category: webserver  product: langflow
detection:
  selection:
    cs-method: POST    cs-uri-stem|contains:
      - '/api/v1/refresh'      - '/api/v1/login'    cs-referer|contains|all:
      - 'http'    cs-headers|contains: 'Origin'
  filter_legit:
    cs-referer|contains:
      - '127.0.0.1'      - 'localhost'
  cross_origin:
    cs-referer|re: '^https?://(?!127\.0\.0\.1|localhost)'
  condition: selection and cross_origin and not filter_legit
fields:
  - c-ip  - cs-uri-stem  - cs-referer  - cs-headers  - time-taken
falsepositives:
  - Legitimate cross-origin integrations with explicitly trusted hosts
level: high

# SIGMA pseudocode: Detects anomalous ordering parameter injection in Ghost Content API
# requests consistent with CVE-2026-26980 blind SQL injection exploitation.

title: Ghost CMS Content API SQLi Exploitation Attempt (CVE-2026-26980)
id: d9c2e445-ff01-4b72-a831-0057c3d89a12
status: experimental
description: Detects anomalous ordering parameter injection in Ghost Content API requests consistent with CVE-2026-26980 blind SQL injection exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-26980
author: NightWatch CTI
date: 2026-06-07
tags:
  - attack.initial_access  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/ghost/api/content/'    cs-uri-query|contains:
      - 'order='
  sqli_patterns:
    cs-uri-query|re|i: '(order=.*(\bcase\b|\bwhen\b|\bthen\b|\bselect\b|\bunion\b|\bsleep\b|\bbenchmark\b))'
  condition: selection and sqli_patterns
fields:
  - c-ip  - cs-uri-stem  - cs-uri-query  - sc-status  - time-taken
falsepositives:
  - None expected for SQL keyword injection in ordering parameters
level: high

# SIGMA pseudocode: Detects successful SSL-VPN authentications using SAM account name
# format where UPN-format MFA policy is expected, indicating potential MFA bypass.

title: SonicWall SSL-VPN MFA Bypass via SAM/UPN Divergence (CVE-2024-12802)
id: e1a3bc77-9032-4d19-bfe3-1198ded3f204
status: experimental
description: Detects successful SSL-VPN authentications using SAM account name format where UPN-format MFA policy is expected, indicating potential MFA bypass.
references:
  - https://www.sentinelone.com/vulnerability-database/cve-2024-12802/
author: NightWatch CTI
date: 2026-06-07
tags:
  - attack.defense_evasion  - attack.t1556.006  - attack.initial_access
logsource:
  product: sonicwall  service: sslvpn
detection:
  selection:
    EventID: 'auth_success'    auth_method: 'active_directory'
  sam_format:
    username|re: '^[^@]+$'
  no_mfa_challenge:
    mfa_completed: 'false'
  condition: selection and sam_format and no_mfa_challenge
fields:
  - src_ip  - username  - auth_method  - mfa_completed  - session_id
falsepositives:
  - Legacy service accounts using SAM format with MFA exceptions
level: critical

rule EKZ_Infostealer_FortiClient_Lure {
    meta:
        description = "Detects EKZ infostealer samples masquerading as Fortinet patches"
        author      = "NightWatch CTI"
        date        = "2026-06-07"
        reference   = "Arctic Wolf — CVE-2026-35616 FortiClient EMS exploitation"
        tags        = "infostealer, forticlient, ekz, t1539"
    strings:
        $fortinet_lure1 = "FortiClient" ascii wide nocase
        $fortinet_lure2 = "EMS_Patch" ascii wide nocase
        $fortinet_lure3 = "fortinet_update" ascii wide nocase
        $cookie_steal1  = "AppData\\Local\\Google\\Chrome\\User Data" ascii wide
        $cookie_steal2  = "Cookies" ascii wide
        $cookie_steal3  = "Login Data" ascii wide
        $exfil_marker   = "POST" ascii
        $encrypt1       = { 6A 00 68 00 30 00 00 }
        $mutex_pattern  = "EKZ_" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        (2 of ($fortinet_lure*)) and
        (2 of ($cookie_steal*)) and
        $exfil_marker and
        (1 of ($mutex_pattern, $encrypt1))
}

-- SIEM pseudocode (generic, adapt to your ingestion schema)
-- Detects POST requests to Serv-U endpoints with deflate Content-Encoding
-- Relevant to CVE-2026-28318 active exploitation

SELECT
    src_ip,
    dst_ip,
    dst_port,
    http_method,
    http_uri,
    http_content_encoding,
    event_time,
    COUNT(*) AS request_count
FROM web_proxy_logs
WHERE
    http_method = 'POST'
    AND http_content_encoding ILIKE '%deflate%'
    AND (
        http_uri ILIKE '%/Web%20Client/%'
        OR dst_port IN (443, 8443, 80)
    )
    AND event_time >= NOW() - INTERVAL '24 HOURS'
GROUP BY src_ip, dst_ip, dst_port, http_method, http_uri, http_content_encoding, event_time
HAVING COUNT(*) >= 1
ORDER BY event_time DESC;

-- SIEM Splunk SPL: Palo Alto PAN-OS CVE-2026-0257 Override Cookie Exploitation

index=paloalto sourcetype=pan:traffic OR sourcetype=pan:globalprotect
| search app="globalprotect" action="allow"
| eval auth_method=coalesce(auth_method, "unknown")
| where auth_method="override_cookie" OR (like(log_subtype, "%override%") AND action="allow")
| lookup threat_intel_ips ip AS src_ip OUTPUT reputation
| eval suspicious_infra=if(
    match(src_ip, "^(104\.21\.|172\.67\.|45\.14\.)") OR
    reputation="malicious", 1, 0)
| where suspicious_infra=1 OR auth_method="override_cookie"
| stats count min(_time) AS first_seen max(_time) AS last_seen values(src_ip) AS source_ips values(dst_ip) AS gateway_ips values(user) AS users BY host
| where count > 0
| eval risk_score=case(
    auth_method="override_cookie" AND suspicious_infra=1, 95,
    auth_method="override_cookie", 80,
    suspicious_infra=1, 70,
    true(), 50)
| sort - risk_score
| table host, users, source_ips, gateway_ips, first_seen, last_seen, count, risk_score