SmarterMail Unrestricted File Upload Exploitation (CVE-2025-52691)

union DeviceFileEvents, DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any ("mail", "smartermail", "smtp")
| where (
    (ActionType == "FileCreated" and FileName matches regex @"\.(aspx|asp|php|jsp|cfm|cgi|pl|py|rb|sh|exe|dll|bat|cmd|ps1|vbs|hta)$"
      and FolderPath matches regex @"(?i)(smartermail|smarter\\mail|mailroot|webmail)")
    or
    (ActionType in ("ProcessCreated") and InitiatingProcessName =~ "SmarterMail.exe"
      and FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "rundll32.exe", "regsvr32.exe"))
  )
| extend RiskIndicator = case(
    ActionType == "FileCreated" and FileName matches regex @"\.(aspx|asp|php|jsp)$", "WebShellDrop",
    ActionType == "ProcessCreated" and InitiatingProcessName =~ "SmarterMail.exe", "SuspiciousChildProcess",
    "UnknownUpload"
  )
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessName, InitiatingProcessCommandLine, RiskIndicator, AccountName

index=wineventlog OR index=sysmon OR index=endpoint
| eval lower_path=lower(FilePath), lower_proc=lower(ParentProcessName), lower_file=lower(FileName)
| where (lower_path LIKE "%smartermail%" OR lower_path LIKE "%smarter\\mail%" OR lower_path LIKE "%mailroot%" OR lower_path LIKE "%webmail%")
  AND (
    (EventCode=11 AND match(lower_file, "\.(aspx|asp|php|jsp|cfm|cgi|pl|py|rb|sh|exe|dll|bat|cmd|ps1|vbs|hta)$"))
    OR
    (EventCode=1 AND lower_proc LIKE "%smartermail%" AND (lower_file LIKE "%cmd.exe%" OR lower_file LIKE "%powershell.exe%" OR lower_file LIKE "%wscript.exe%" OR lower_file LIKE "%cscript.exe%" OR lower_file LIKE "%mshta.exe%" OR lower_file LIKE "%certutil.exe%"))
  )
| eval RiskIndicator=case(
    EventCode=11 AND match(lower_file, "\.(aspx|asp|php|jsp)$"), "WebShellDrop",
    EventCode=1, "SuspiciousChildProcess",
    true(), "UnknownUpload"
  )
| table _time, host, user, lower_path, lower_file, lower_proc, CommandLine, RiskIndicator
| sort -_time

sequence by host.name with maxspan=5m
  [
    network where process.name : "SmarterMail.exe"
      and network.direction : "ingress"
      and destination.port in (80, 443, 8080, 9998)
  ] by host.name
  [
    file where event.action : "creation"
      and process.name : "SmarterMail.exe"
      and file.extension : ("aspx", "asp", "php", "jsp", "cfm", "cgi", "pl", "exe", "dll", "bat", "cmd", "ps1", "vbs", "hta")
      and file.path : ("*smartermail*", "*SmarterMail*", "*mailroot*", "*webmail*")
  ] by host.name

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
       sourceip, destinationip, username, filename, filepath,
       QIDNAME(qid) AS EventName, logsourcename(logsourceid) AS LogSource
FROM events
WHERE LOGSOURCE = 'Windows' AND CATEGORY = 'File System'
  AND (
    (filename IMATCHES '.*\.(aspx|asp|php|jsp|cfm|cgi|pl|exe|dll|bat|cmd|ps1|vbs|hta)$'
     AND (filepath IMATCHES '.*smartermail.*' OR filepath IMATCHES '.*mailroot.*' OR filepath IMATCHES '.*webmail.*'))
    OR
    (EventName IMATCHES '.*process.*create.*'
     AND username IMATCHES '.*smartermail.*'
     AND filename IMATCHES '.*(cmd|powershell|wscript|cscript|mshta|certutil)\.exe$')
  )
  AND LOGSOURCE_LAST(starttime) > NOW() - 7 DAYS
ORDER BY starttime DESC
LAST 7 DAYS

_sourceCategory=windows/sysmon OR _sourceCategory=endpoint/events
| json field=_raw "EventID", "Image", "TargetFilename", "ParentImage", "CommandLine", "Computer"
| where (
    (EventID = "11"
      AND (TargetFilename matches "*smartermail*" OR TargetFilename matches "*mailroot*" OR TargetFilename matches "*webmail*")
      AND (TargetFilename matches "*.aspx" OR TargetFilename matches "*.asp" OR TargetFilename matches "*.php"
           OR TargetFilename matches "*.jsp" OR TargetFilename matches "*.exe" OR TargetFilename matches "*.dll"
           OR TargetFilename matches "*.bat" OR TargetFilename matches "*.cmd" OR TargetFilename matches "*.ps1"
           OR TargetFilename matches "*.vbs" OR TargetFilename matches "*.hta"))
    OR
    (EventID = "1"
      AND (ParentImage matches "*SmarterMail.exe*" OR ParentImage matches "*smartermail.exe*")
      AND (Image matches "*cmd.exe" OR Image matches "*powershell.exe" OR Image matches "*wscript.exe"
           OR Image matches "*cscript.exe" OR Image matches "*mshta.exe" OR Image matches "*certutil.exe"))
  )
| fields Computer, EventID, Image, TargetFilename, ParentImage, CommandLine
| sort by _messagetime desc

rule cve_2025_52691_smartermail_file_upload {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects unrestricted file upload exploitation in SmarterMail (CVE-2025-52691)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-52691"

  events:
    (
      $e.metadata.event_type = "FILE_CREATION"
      and re.regex($e.target.file.full_path, `(?i)(smartermail|mailroot|webmail)`)
      and re.regex($e.target.file.full_path, `(?i)\.(aspx|asp|php|jsp|cfm|cgi|pl|exe|dll|bat|cmd|ps1|vbs|hta)$`)
    )
    or
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e.principal.process.file.full_path, `(?i)smartermail\.exe`)
      and re.regex($e.target.process.file.full_path, `(?i)(cmd|powershell|wscript|cscript|mshta|certutil)\.exe`)
    )

  condition:
    $e
}

event_simpleName IN ("FileCreate", "ProcessRollup2")
| eval lower_path=lower(TargetFileName), lower_image=lower(ImageFileName), lower_parent=lower(ParentBaseFileName)
| where (
    (event_simpleName="FileCreate"
      AND (lower_path LIKE "%smartermail%" OR lower_path LIKE "%mailroot%" OR lower_path LIKE "%webmail%")
      AND match(lower_path, @"\.(aspx|asp|php|jsp|cfm|cgi|pl|exe|dll|bat|cmd|ps1|vbs|hta)$"))
    OR
    (event_simpleName="ProcessRollup2"
      AND lower_parent LIKE "%smartermail.exe%"
      AND (lower_image LIKE "%cmd.exe%" OR lower_image LIKE "%powershell.exe%" OR lower_image LIKE "%wscript.exe%"
           OR lower_image LIKE "%cscript.exe%" OR lower_image LIKE "%mshta.exe%" OR lower_image LIKE "%certutil.exe%"))
  )
| table _time, ComputerName, UserName, event_simpleName, TargetFileName, ImageFileName, ParentBaseFileName, CommandLine
| sort -_time