Inferlume

title: SharePoint Trust Endpoint Anomalous POST After Deserialization PoC Pattern
id: nwatch-2026-07-sp-trust-post
status: experimental
description: Detects high risk POSTs to SharePoint trust sign in endpoints associated with CVE-2026-50522 exploit shape
logsource:
  product: webserver
  service: iis
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/_trust/default.aspx'
  selection_method:
    cs-method: POST
  selection_suspicious:
    cs-bytes|gt: 4000
  timeframe: 5m
  condition: selection_path and selection_method and selection_suspicious
falsepositives:
  - Legitimate federated sign in bursts
level: high
tags:
  - attack.t1190
  - cve.2026.50522

title: Suspicious SharePoint Exploitation Patterns
status: experimental
logsource:
  category: webserver
  product: windows
detection:
  selection:
    cs_uri_query|contains:
      - "X-Ms-"
      - "aspnet_client"
      - "ToolPane"
      - "CentralAdministration"
  selection2:
    cs_method:
      - POST
      - GET
  condition: selection and selection2
fields:
  - src_ip
  - url
  - cs_uri_query
  - user_agent
falsepositives:
  - Legitimate SharePoint administration
level: high

title: Suspicious SharePoint Deserialization Process Execution
id: f482a912-3490-4821-9bc1-12948a390112
status: experimental
description: Detects w3wp.exe spawning PowerShell or command shell after SharePoint activity
author: NightWatch
date: 2026/07/24
logsource:
  category: process_creation
  product: windows
detection:
  parent_process:
    ParentImage|endswith: '\w3wp.exe'
  child_process:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
  command_line_args:
    CommandLine|contains:
      - 'EncodedCommand'
      - 'DownloadString'
      - 'Bypass'
      - 'Invoke-Expression'
  condition: parent_process and child_process and command_line_args
falsepositives:
  - Administrative scripts executed via SharePoint web controls
level: high
tags:
  - attack.t1190
  - attack.t1059.001

title: Check Point Management Suspicious Admin Token Use
id: nwatch-2026-07-cp-smartconsole-token
status: experimental
description: Flag admin sessions or policy publishes from unexpected sources when hunting CVE-2026-16232 residual risk
logsource:
  product: checkpoint
  service: management
detection:
  selection:
    event_type:
      - admin_login
      - policy_install
      - application_token_auth
  filter_unexpected:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
      - '172.16.0.0/12'
  condition: selection and not filter_unexpected
level: high
tags:
  - attack.t1078
  - cve.2026.16232

title: Suspicious PowerShell Execution via Run Dialog (ClickFix Pattern)
id: 7a1e2c44-c9b2-4e10-a1f0-clickfix2026
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\explorer.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '-enc'
      - 'IEX'
      - 'DownloadString'
      - 'Invoke-Expression'
  condition: selection
falsepositives:
  - Legitimate admin scripts launched manually (rare via explorer parent)
level: high

rule SharePoint_MachineKey_Theft_Signs
{
  meta:
    description = "Heuristic pattern for post exploitation SharePoint web artifact abuse"
    author = "NightWatch"
    status = "experimental"
  strings:
    $a1 = "machineKey"
    $a2 = "ViewState"
    $a3 = "CentralAdministration"
    $a4 = "deserialization"
  condition:
    2 of them
}

rule NightWatch_Webshell_ASPX_Eval_Heuristic
{
    meta:
        description = "Heuristic ASPX webshell markers post RCE waves"
        author = "NightWatch"
        date = "2026-07-26"
    strings:
        $s1 = "System.Diagnostics.Process" ascii nocase
        $s2 = "Request.Form" ascii nocase
        $s3 = "eval(" ascii nocase
        $s4 = "FromBase64String" ascii nocase
        $s5 = "cmd.exe" ascii nocase
    condition:
        uint16(0) == 0x253C
        and 3 of them
}

rule Exploit_FortiSandbox_CmdInjection_Payload
{
    meta:
        description = "Detects web shells and reverse shell payloads associated with CVE-2026-25089 style exploitation"
        author = "NightWatch"
        date = "2026-07-25"
        score = 80
    strings:
        $s1 = "/bin/sh -c" ascii
        $s2 = "wget http" ascii
        $s3 = "curl -s http" ascii
        $s4 = "/tmp/.forti_" ascii
        $p1 = "POST /cgi-bin/forticonfig" ascii
    condition:
        uint32(0) == 0x464C457F or ($p1 and 2 of ($s*))
}

rule Suspicious_Rust_Backdoor_ChromeCDP
{
    meta:
        description = "Heuristic for Rust compiled binaries invoking Chrome DevTools Protocol endpoints"
        confidence = "medium behavioral inference not sample verified"
    strings:
        $rust1 = "rust_begin_unwind"
        $cdp1 = "ws://127.0.0.1:9222"
        $cdp2 = "Runtime.evaluate"
    condition:
        $rust1 and 1 of ($cdp*)
}

SELECT src_ip, dst_host, url, status, user_agent, count(*) AS hits
FROM web_logs
WHERE (
  url CONTAINS "SharePoint"
  OR url CONTAINS "SMA"
  OR url CONTAINS "GlobalProtect"
)
AND (
  status IN (200, 302, 500)
  OR user_agent LIKE "%python%"
  OR user_agent LIKE "%curl%"
)
GROUP BY src_ip, dst_host, url, status, user_agent
HAVING hits > 20
ORDER BY hits DESC;

FROM process_events p
JOIN file_events f ON p.host = f.host AND p.timestamp BETWEEN f.timestamp - 2m AND f.timestamp + 10m
WHERE
  p.parent_process_name IN ("w3wp.exe", "owstimer.exe")
  AND (
    p.process_name IN ("cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe")
    OR f.file_path CONTAINS_ANY ("web.config", "machineKey", "ValidationKey", "DecryptionKey")
  )
  AND p.user NOT IN expected_service_accounts
EMIT alert(severity=high, technique="T1190/T1505", cve_context="CVE-2026-50522")

FROM http_access h
WHERE h.uri CONTAINS "/wp-json/" AND h.uri CONTAINS "batch"
  AND h.method = "POST"
  AND h.status IN (200, 201, 500)
JOIN process_events p ON h.host = p.host
  AND p.process_name IN ("php", "php-fpm", "bash", "sh")
  AND p.command_line CONTAINS_ANY ("base64", "wget", "curl", "/tmp/")
WITHIN 3 minutes
EMIT alert(severity=critical, cve_context="CVE-2026-63030/CVE-2026-60137")

index=network sourcetype=proxy OR sourcetype=dns
| eval suspicious_port=if(dest_port IN (9222,9229), 1, 0)
| where suspicious_port=1 OR (protocol="webrtc" AND bytes_out > 500000)
| stats count by src_ip, dest_ip, process_name
| where count > 20
| eval risk_score=case(process_name IN ("chrome.exe","msedge.exe") AND count>50, "high", 1=1, "medium")

CommonSecurityLog
| where DeviceVendor == "Check Point"
| where DeviceProduct == "SmartConsole" or Activity == "Authentication"
| where DeviceAction in~ ("Failed", "Bypass", "Unauthorized") or NoticeCode == "CVE-2026-16232"
| summarize AttemptCount = count(), UniqueIPs = dcount(SourceIP) by DestinationIP, UserAgent, bin(TimeGenerated, 15m)
| where AttemptCount > 10