Sangoma FreePBX OS Command Injection (CVE-2025-64328)

let FreePBXProcesses = dynamic(["asterisk", "freepbx", "amportal", "php", "httpd", "apache2", "nginx"]);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessParentFileName has_any (FreePBXProcesses)
    or InitiatingProcessFileName has_any (FreePBXProcesses)
| where FileName in~ ("sh", "bash", "dash", "ksh", "zsh", "python", "python3", "perl", "nc", "ncat", "netcat", "curl", "wget", "base64", "id", "whoami", "uname")
| where ProcessCommandLine has_any ("wget", "curl", "chmod", "bash -i", "/dev/tcp", "python -c", "perl -e", "nc -e", "mkfifo", "base64 -d", "socat", "id;", "whoami;")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| order by TimeGenerated desc

index=linux sourcetype IN ("linux_audit", "syslog", "auditd") 
("asterisk" OR "freepbx" OR "amportal" OR "httpd" OR "apache2")
| eval suspicious_cmd=if(match(process, "(wget|curl|chmod\s+[0-7]+|bash\s+-i|/dev/tcp|python\s+-c|perl\s+-e|nc\s+-e|mkfifo|base64\s+-d|socat|id;|whoami;|ncat)"), 1, 0)
| where suspicious_cmd=1
| eval parent_suspicious=if(match(parent_process, "(asterisk|freepbx|amportal|httpd|apache2|nginx|php)"), 1, 0)
| where parent_suspicious=1
| table _time, host, user, process, parent_process, dest
| sort - _time

process where event.type == "start"
  and process.parent.name in ("asterisk", "freepbx", "amportal", "httpd", "apache2", "php", "nginx")
  and process.name in ("sh", "bash", "dash", "ksh", "zsh", "python", "python3", "perl", "nc", "ncat", "netcat", "curl", "wget", "id", "whoami", "uname", "base64", "socat", "mkfifo")
  and (
    process.command_line like~ "*wget *"
    or process.command_line like~ "*curl *"
    or process.command_line like~ "*bash -i*"
    or process.command_line like~ "*/dev/tcp*"
    or process.command_line like~ "*python -c*"
    or process.command_line like~ "*perl -e*"
    or process.command_line like~ "*nc -e*"
    or process.command_line like~ "*mkfifo*"
    or process.command_line like~ "*base64 -d*"
    or process.command_line like~ "*socat*"
  )

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
       sourceip, destinationip, username, "Process Name", "Command", "Parent Process Name"
FROM events
WHERE LOGSOURCENAME(logsourceid) ILIKE '%linux%'
  AND ("Parent Process Name" ILIKE '%asterisk%'
    OR "Parent Process Name" ILIKE '%freepbx%'
    OR "Parent Process Name" ILIKE '%httpd%'
    OR "Parent Process Name" ILIKE '%apache2%'
    OR "Parent Process Name" ILIKE '%php%')
  AND ("Process Name" IN ('sh', 'bash', 'dash', 'ksh', 'python', 'python3', 'perl', 'nc', 'curl', 'wget', 'socat', 'mkfifo', 'base64', 'id', 'whoami')
    OR "Command" ILIKE '%/dev/tcp%'
    OR "Command" ILIKE '%bash -i%'
    OR "Command" ILIKE '%python -c%'
    OR "Command" ILIKE '%perl -e%')
LAST 24 HOURS

_sourceCategory=linux/audit OR _sourceCategory=syslog/linux
| where (%"parent_process" matches /asterisk|freepbx|amportal|httpd|apache2|nginx|php/ or %"ppid_comm" matches /asterisk|freepbx|httpd|apache2/)
| where (%"process" matches /sh|bash|dash|python|perl|nc|ncat|curl|wget|socat|mkfifo|base64|id|whoami/)
| where (%"cmdline" matches /wget |curl |bash -i|dev\/tcp|python -c|perl -e|nc -e|mkfifo|base64 -d|socat/)
| fields _messagetime, _sourceHost, user, process, %"cmdline", %"parent_process"
| sort by _messagetime desc

rule freepbx_os_command_injection_cve_2025_64328 {
  meta:
    author = "df00tech"
    description = "Detects OS command injection exploitation in Sangoma FreePBX (CVE-2025-64328)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-64328"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.parent_process.file.full_path = /asterisk|freepbx|amportal|httpd|apache2|php|nginx/
    (
      $e.principal.process.file.full_path = /\/(sh|bash|dash|ksh|python3?|perl|nc|ncat|curl|wget|socat|base64|id|whoami)$/
      or $e.principal.process.command_line = /bash -i|dev\/tcp|python -c|perl -e|nc -e|mkfifo|base64 -d|socat/
    )

  condition:
    $e
}

event_simpleName=ProcessRollup2
| search ParentBaseFileName IN ("asterisk", "httpd", "apache2", "php", "nginx", "amportal")
| search FileName IN ("sh", "bash", "dash", "ksh", "python", "python3", "perl", "nc", "ncat", "curl", "wget", "socat", "base64", "id", "whoami", "mkfifo")
| search CommandLine IN ("*wget *", "*curl *http*", "*bash -i*", "*/dev/tcp*", "*python -c*", "*perl -e*", "*nc -e*", "*mkfifo*", "*base64 -d*", "*socat*")
| table _time, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ParentCommandLine
| sort - _time