Quest KACE SMA Improper Authentication Exploitation Detected

let KACEPorts = dynamic([80, 443, 8080, 8443]);
let SuspiciousEndpoints = dynamic(["/admin", "/userui", "/api", "/service/ambari", "/api/users", "/admin/index.php"]);
union DeviceNetworkEvents, CommonSecurityLog
| where TimeGenerated >= ago(24h)
| where DestinationPort in (KACEPorts) or DestPort in (KACEPorts)
| extend RequestURL = coalesce(RequestURL, DestinationURL, ""), SrcIP = coalesce(SourceIP, RemoteIP, "")
| where RequestURL has_any (SuspiciousEndpoints)
| where isnotempty(SrcIP)
| summarize RequestCount = count(), DistinctEndpoints = dcount(RequestURL), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Endpoints = make_set(RequestURL, 20) by SrcIP, DestinationIP, DestinationPort
| where RequestCount > 10 or DistinctEndpoints > 3
| extend RiskScore = case(
    RequestCount > 50 and DistinctEndpoints > 5, "High",
    RequestCount > 20, "Medium",
    "Low"
  )
| project FirstSeen, LastSeen, SrcIP, DestinationIP, DestinationPort, RequestCount, DistinctEndpoints, Endpoints, RiskScore
| order by RequestCount desc

index=network OR index=web sourcetype=access_combined OR sourcetype=cisco:asa OR sourcetype=pan:traffic OR sourcetype=stream:http
| where (dest_port=80 OR dest_port=443 OR dest_port=8080 OR dest_port=8443)
| where (uri_path="/admin*" OR uri_path="/userui*" OR uri_path="/api/users*" OR uri_path="/service*" OR uri_path="/admin/index.php*")
| eval is_suspicious_method=if(method="GET" AND match(uri_path, "(?i)(admin|userui|api/users|service/ambari)"), 1, 0)
| eval is_auth_bypass=if((status=200 OR status=302) AND match(uri_path, "(?i)(admin|userui)") AND isnull(cookie) OR len(cookie)<10, 1, 0)
| stats count AS request_count, dc(uri_path) AS distinct_endpoints, values(uri_path) AS endpoints, values(status) AS response_codes, min(_time) AS first_seen, max(_time) AS last_seen, sum(is_auth_bypass) AS auth_bypass_indicators BY src_ip, dest_ip, dest_port
| where request_count > 5 OR auth_bypass_indicators > 0
| eval risk_score=case(auth_bypass_indicators>0 AND request_count>20, "critical", auth_bypass_indicators>0, "high", request_count>50 AND distinct_endpoints>5, "high", request_count>20, "medium", true(), "low")
| table first_seen, last_seen, src_ip, dest_ip, dest_port, request_count, distinct_endpoints, endpoints, response_codes, auth_bypass_indicators, risk_score
| sort - request_count

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and
   destination.port in (80, 443, 8080, 8443) and
   url.path : ("/admin*", "/userui*", "/api/users*", "/service/*")]
  [network where event.category == "network" and
   destination.port in (80, 443, 8080, 8443) and
   url.path : ("/admin*", "/userui*", "/api/users*", "/service/*") and
   http.response.status_code in (200, 302, 301)]
| where #sequencesFound >= 2

SELECT sourceip, destinationip, destinationport, URL, username, eventcount, MIN(starttime) AS first_seen, MAX(starttime) AS last_seen,
  SUM(CASE WHEN URL LIKE '%/admin%' OR URL LIKE '%/userui%' OR URL LIKE '%/api/users%' THEN 1 ELSE 0 END) AS admin_requests,
  SUM(CASE WHEN responseCode IN (200, 302, 301) AND (URL LIKE '%/admin%' OR URL LIKE '%/userui%') THEN 1 ELSE 0 END) AS successful_admin_access
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'Nginx', 'F5 BIG-IP')
  AND destinationport IN (80, 443, 8080, 8443)
  AND (URL LIKE '%/admin%' OR URL LIKE '%/userui%' OR URL LIKE '%/api%' OR URL LIKE '%/service%')
  AND LAST 24 HOURS
GROUP BY sourceip, destinationip, destinationport, URL, username
HAVING admin_requests > 10 OR successful_admin_access > 3
ORDER BY admin_requests DESC

_sourceCategory=network/web OR _sourceCategory=firewall/paloalto OR _sourceCategory=proxy/bluecoat
| where (dest_port=80 OR dest_port=443 OR dest_port=8080 OR dest_port=8443)
| parse regex field=url "(?P<path>/[^\?]*)" nodrop
| where path matches "/admin*" OR path matches "/userui*" OR path matches "/api/users*" OR path matches "/service*"
| timeslice 5m
| stats count as request_count, dcount(path) as distinct_paths, values(path) as paths_accessed, dcount(status_code) as response_variety, sum(if(status_code=200 OR status_code=302, 1, 0)) as successful_requests by src_ip, dest_ip, _timeslice
| where request_count > 10 OR (successful_requests > 3 AND distinct_paths > 2)
| fields - _timeslice
| sort by request_count desc

rule quest_kace_sma_auth_bypass_cve_2025_32975 {
  meta:
    author = "Detection Engineering"
    description = "Detects potential CVE-2025-32975 exploitation against Quest KACE SMA - improper authentication bypass"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-32975"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.application_protocol = "HTTP" or $e.network.application_protocol = "HTTPS"
    $e.target.port = 80 or $e.target.port = 443 or $e.target.port = 8080 or $e.target.port = 8443
    (
      re.regex($e.network.http.request_url, `(?i)/admin`) or
      re.regex($e.network.http.request_url, `(?i)/userui`) or
      re.regex($e.network.http.request_url, `(?i)/api/users`) or
      re.regex($e.network.http.request_url, `(?i)/service/ambari`)
    )
    $e.network.http.response_code = 200 or
    $e.network.http.response_code = 302
    $src_ip = $e.principal.ip

  match:
    $src_ip over 10m

  outcome:
    $event_count = count_distinct($e.metadata.id)
    $distinct_urls = count_distinct($e.network.http.request_url)
    $target_ips = array_distinct($e.target.ip)

  condition:
    #e > 5 and $distinct_urls > 2
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=HttpRequest
| TargetPort IN (80, 443, 8080, 8443)
| HttpRequestUrl IN CIREGEX ("(?i)/admin", "(?i)/userui", "(?i)/api/users", "(?i)/service/ambari")
| stats count(HttpRequestUrl) AS request_count, dc(HttpRequestUrl) AS distinct_endpoints, values(HttpRequestUrl) AS endpoints, min(timestamp) AS first_seen, max(timestamp) AS last_seen BY RemoteAddressIP4, TargetPort, HttpResponseCode
| where request_count > 10 OR (HttpResponseCode IN (200, 302) AND distinct_endpoints > 2)
| eval risk = if(HttpResponseCode IN (200, 302) AND distinct_endpoints > 3, "CRITICAL", if(request_count > 30, "HIGH", "MEDIUM"))
| fields first_seen, last_seen, RemoteAddressIP4, TargetPort, request_count, distinct_endpoints, endpoints, HttpResponseCode, risk
| sort -request_count