Inferlume

// YARA Rule: Detect suspicious cPanel session file patterns
// Aligned with CVE-2026-41940 CRLF injection behavior
// Match session files containing root promotion keys injected via CRLF

rule cPanel_CVE_2026_41940_SessionFile_Injection
{
    meta:
        description = "Detects cPanel session files containing CRLF-injected root promotion keys consistent with CVE-2026-41940"
        severity = "critical"
        cve = "CVE-2026-41940"
    strings:
        // Root-level keys that should not appear in a pre-auth session file
        $root_key = "user=root"
        $hasroot = "hasroot=1"
        $tfa_bypass = "tfa_verified=1"
        // Detect CRLF sequences in HTTP header context
        $crlf_inject = { 0D 0A } // raw CRLF bytes
    condition:
        // File is in a cPanel session directory and contains injected root keys
        (filepath matches /\/var\/cpanel\/sessions\//) and
        any of ($root_key, $hasroot, $tfa_bypass)
}

// YARA Rule: Detect BlueHammer-style NTFS junction artifacts
// Aligned with CVE-2026-33825 Defender TOCTOU race exploitation
// Looks for junction point creation targeting System32

rule BlueHammer_CVE_2026_33825_Junction_Artifact
{
    meta:
        description = "Detects artifacts consistent with NTFS junction manipulation targeting System32 as part of BlueHammer exploit chain"
        severity = "high"
        cve = "CVE-2026-33825"
    strings:
        // Junction reparse point magic bytes
        $reparse_tag = { A0 00 00 00 } // IO_REPARSE_TAG_MOUNT_POINT
        // System32 path reference in reparse data
        $sys32_path = "\\Windows\\System32" wide
        // Temp path commonly used in race window
        $temp_path = "\\Windows\\Temp\\" wide
    condition:
        $reparse_tag and $sys32_path and $temp_path
}

# SIGMA Rule: Windows event log detection for BlueHammer privilege escalation
# Detects MsMpEng writing to System32 followed by unexpected SYSTEM process spawn
# CVE-2026-33825

title: BlueHammer Defender TOCTOU Privilege Escalation
id: bf26-33825-sigma-001
status: experimental
description: Detects Defender remediation activity writing to System32 followed by new SYSTEM-level process creation, consistent with CVE-2026-33825 exploit chain
references:
    - CVE-2026-33825
logsource:
    product: windows
    service: sysmon
detection:
    file_write_by_defender:
        EventID: 11  # FileCreate
        Image|endswith: '\MsMpEng.exe'
        TargetFilename|contains: '\Windows\System32\'
    system_process_spawn:
        EventID: 1   # ProcessCreate
        IntegrityLevel: 'System'
        ParentImage|endswith: '\MsMpEng.exe'
    timeframe: 60s
    condition: file_write_by_defender followed by system_process_spawn within timeframe
falsepositives:
    - Legitimate Defender remediation activity in System32 (rare, review carefully)
level: high
tags:
    - attack.privilege_escalation
    - attack.t1068

# SIGMA Rule: Outbound SMB authentication to external hosts
# Aligned with CVE-2026-32202 NTLM hash leak via Windows Shell
# Detect automatic NTLM authentication to non-internal SMB servers

title: Windows Shell NTLM Hash Leak via External SMB Connection
id: cve-32202-sigma-001
status: experimental
description: Detects outbound SMB connections from Windows endpoints to external IP addresses, consistent with CVE-2026-32202 exploitation leaking Net-NTLMv2 hashes
logsource:
    product: windows
    service: security
detection:
    ntlm_auth_event:
        EventID: 4648  # Logon attempt with explicit credentials
        TargetServerName|re: '^(?!10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.).*'
    smb_outbound:
        EventID: 5140  # Network share access
        ShareName: '\\*\*'
        IpAddress|re: '^(?!10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|\:\:1).*'
    condition: ntlm_auth_event or smb_outbound
falsepositives:
    - Legitimate external SMB access (should be rare and known)
    - Cloud storage mapped as SMB shares (review allowlist)
level: high
tags:
    - attack.credential_access
    - attack.t1557.001

// SIEM Pseudocode: Hunt for cPanel root session promotions without prior authentication success
// Platform-agnostic logic, adapt field names to your log schema
// CVE-2026-41940

SEARCH index=cpanel_logs sourcetype=cpanel_access
WHERE session_type = "root" OR privilege_level = "root"
AND NOT preceding_event_type = "password_auth_success"
AND NOT preceding_event_type = "2fa_challenge_passed"
WITHIN 5 minutes BEFORE session_creation_time
GROUP BY source_ip, session_id, session_creation_time
HAVING count(*) >= 1
// Alert: Root session created without corresponding authentication events
// This indicates session file promotion via CRLF injection

// SIEM Pseudocode: Detect Linux kernel privilege escalation consistent with Copy Fail
// CVE-2026-31431
// Platform-agnostic logic, adapt field names to your log schema

SEARCH index=linux_auditd
WHERE syscall IN ("sendmsg", "recvmsg")
AND socket_type = "SOCK_SEQPACKET"
AND process_user != "root"
AND process_effective_uid = 0
// A non-root process acquiring effective UID 0 via socket operations
// is consistent with CVE-2026-31431 kernel page-cache corruption exploit
GROUP BY hostname, process_name, process_pid, process_user
HAVING process_effective_uid = 0 AND process_user != "root"
SORT BY event_time DESC