Array Networks ArrayOS AG OS Command Injection (CVE-2025-66644)

let ArrayNetworksIPs = dynamic([]);
let SuspiciousCommands = dynamic(['wget', 'curl', 'chmod', 'bash', 'sh', 'nc', 'ncat', 'python', 'perl', 'ruby', '/tmp/', '/dev/shm', 'base64', 'id;', 'whoami', 'uname', '&&', '||', '`', '$()']);
union isfuzzy=true
(
  CommonSecurityLog
  | where DeviceVendor has_any ('Array Networks', 'ArrayNetworks')
  | where Activity has_any ('command', 'exec', 'injection', 'shell', 'os')
     or Message has_any (SuspiciousCommands)
  | project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, Activity, Message, AdditionalExtensions
  | extend AlertReason = 'Array Networks device activity with suspicious command patterns'
),
(
  Syslog
  | where Computer has_any ('arrayos', 'array-ag', 'arrayvpn')
     or ProcessName has_any ('ag', 'arrayd', 'arrayos')
  | where SyslogMessage has_any (SuspiciousCommands)
  | project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
  | extend AlertReason = 'ArrayOS syslog with OS command injection indicators'
),
(
  DeviceNetworkEvents
  | where InitiatingProcessFileName has_any ('wget', 'curl', 'nc', 'bash', 'sh', 'python')
  | where InitiatingProcessParentFileName has_any ('ag', 'arrayd', 'httpd', 'nginx')
  | project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
  | extend AlertReason = 'Suspicious child process spawned from Array Networks gateway process'
)
| order by TimeGenerated desc

index=network OR index=syslog OR index=firewall
(vendor="Array Networks" OR vendor="ArrayNetworks" OR product="ArrayOS" OR product="ArrayOS AG" OR host="*array*" OR host="*arrayvpn*")
| eval suspicious_cmd=if(match(coalesce(message, _raw), "(?i)(wget|curl|chmod|bash|\bsh\b|\bnc\b|ncat|python|perl|ruby|\/tmp\/|\/dev\/shm|base64|whoami|id;|uname|&&|\|\||`|\$\()"), 1, 0)
| where suspicious_cmd=1
| eval injection_score=0
| eval injection_score=injection_score + if(match(coalesce(message, _raw), "(?i)(wget|curl|python|perl|ruby)"), 3, 0)
| eval injection_score=injection_score + if(match(coalesce(message, _raw), "(?i)(\/tmp\/|\/dev\/shm)"), 2, 0)
| eval injection_score=injection_score + if(match(coalesce(message, _raw), "(?i)(&&|\|\||`|\$\()"), 2, 0)
| eval injection_score=injection_score + if(match(coalesce(message, _raw), "(?i)(chmod|bash|\bsh\b|\bnc\b|ncat)"), 2, 0)
| eval injection_score=injection_score + if(match(coalesce(message, _raw), "(?i)(whoami|id;|uname)"), 1, 0)
| where injection_score >= 3
| stats count AS event_count, max(injection_score) AS max_score, values(src_ip) AS source_ips, values(dest_ip) AS dest_ips, earliest(_time) AS first_seen, latest(_time) AS last_seen BY host, sourcetype
| eval cve="CVE-2025-66644", severity="critical"
| sort -max_score

sequence by host.name with maxspan=5m
  [network where network.application == "ssl-vpn"
   and (destination.port == 443 or destination.port == 8443 or destination.port == 4433)
   and source.ip != null]
  [process where process.name in ("bash", "sh", "dash", "wget", "curl", "nc", "python", "python3", "perl", "ruby")
   and (
     process.parent.name in ("httpd", "nginx", "ag", "arrayd", "java")
     or process.args : ("/tmp/*", "/dev/shm/*", "*base64*", "*whoami*", "*id*", "*uname*")
   )
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip AS src_ip,
  destinationip AS dst_ip,
  username,
  QIDNAME(qid) AS event_name,
  category,
  devicetype,
  logsourcename(logsourceid) AS log_source,
  "Text" AS event_payload,
  magnitude
FROM events
WHERE
  (
    logsourcetypename(devicetype) ILIKE '%array%'
    OR "Text" ILIKE '%arrayos%'
    OR "Text" ILIKE '%array-ag%'
  )
  AND (
    "Text" ILIKE '%wget%'
    OR "Text" ILIKE '%curl %'
    OR "Text" ILIKE '%chmod%'
    OR "Text" ILIKE '% bash %'
    OR "Text" ILIKE '%/bin/sh%'
    OR "Text" ILIKE '%/tmp/%'
    OR "Text" ILIKE '%/dev/shm%'
    OR "Text" ILIKE '%whoami%'
    OR "Text" ILIKE '%base64%'
    OR "Text" ILIKE '%python%'
    OR "Text" ILIKE '%perl %'
    OR "Text" ILIKE '%ncat %'
    OR "Text" ILIKE '% nc %'
  )
LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory=network/arraynetworks OR _sourceCategory=firewall/array OR _sourceHost=*array*
| where (%"vendor" = "Array Networks" or %"product" contains "ArrayOS" or _sourceHost matches "*array*")
| where _raw matches "(?i)(wget|curl|chmod|/bin/bash|/bin/sh|/tmp/|/dev/shm|whoami|base64|python|perl|ncat|\bnc\b)"
| parse regex field=_raw "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" multi
| parse regex field=_raw "(?<suspicious_cmd>wget|curl|chmod|bash|/bin/sh|/tmp/[^\s]+|whoami|base64|python|perl|ncat)" nodrop
| count by _sourceHost, src_ip, suspicious_cmd
| where _count > 0
| sort by _count desc

rule cve_2025_66644_array_networks_cmd_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-66644 OS command injection exploitation against Array Networks ArrayOS AG"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-66644"

  events:
    (
      $e.metadata.event_type = "NETWORK_CONNECTION"
      or $e.metadata.event_type = "STATUS_UPDATE"
    )
    and (
      $e.principal.application = "ArrayOS AG"
      or $e.target.application = "ArrayOS AG"
      or re.regex($e.principal.hostname, `(?i)array`)
      or re.regex($e.target.hostname, `(?i)array`)
    )
    and re.regex($e.metadata.description,
      `(?i)(wget|curl|chmod|/bin/bash|/bin/sh|/tmp/|/dev/shm|whoami|base64|python|perl|\bnc\b|ncat|&&|\|\|)`
    )

  condition:
    $e
}

#event_simpleName IN (ProcessRollup2, SyntheticProcessRollup2, NetworkConnectIP4)
| ParentBaseFileName IN ("ag", "arrayd", "httpd", "nginx", "java")
  OR (event_simpleName = "NetworkConnectIP4" AND RemotePort IN (443, 8443, 4433))
| FileName IN ("wget", "curl", "bash", "sh", "nc", "ncat", "python", "python3", "perl", "ruby", "chmod")
  OR CommandLine = ~".*(/tmp/|/dev/shm|whoami|id;|uname|base64|&&|\|\|).*"
| groupby([ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, RemoteIP, RemotePort])
| count() AS event_count
| sort -event_count
| head 100