Ahsay AhsayCBS Command Injection (CVE-2026-105134)

let AhsayParents = dynamic(["java.exe","javaw.exe","AhsayCBS.exe","httpd.exe","tomcat.exe","catalina.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","bash.exe","sh.exe","wscript.exe","cscript.exe","certutil.exe","bitsadmin.exe","curl.exe","wget.exe","whoami.exe","net.exe","net1.exe","nltest.exe"]);
DeviceProcessEvents
| where InitiatingProcessFileName in~ (AhsayParents) or InitiatingProcessFolderPath has_any ("AhsayCBS","Ahsay\\")
| where FileName in~ (SuspiciousChildren)
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ReportId
| sort by Timestamp desc

index=endpoint (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="Sysmon") EventCode=1
| eval parent=lower(ParentImage), child=lower(Image)
| where (like(parent,"%java.exe") OR like(parent,"%javaw.exe") OR like(parent,"%ahsaycbs%") OR like(parent,"%tomcat%") OR like(parent,"%catalina%"))
| where (like(child,"%cmd.exe") OR like(child,"%powershell.exe") OR like(child,"%pwsh.exe") OR like(child,"%bash.exe") OR like(child,"%\\sh.exe") OR like(child,"%certutil.exe") OR like(child,"%bitsadmin.exe") OR like(child,"%curl.exe") OR like(child,"%wget.exe") OR like(child,"%whoami.exe") OR like(child,"%nltest.exe") OR like(child,"%net.exe"))
| table _time host User ParentImage Image CommandLine ParentCommandLine
| sort - _time

process where event.type == "start" and
  (process.parent.name : ("java.exe","javaw.exe","AhsayCBS.exe","tomcat.exe","catalina.exe","httpd","java") or
   process.parent.executable : ("*AhsayCBS*","*Ahsay*")) and
  process.name : ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","certutil.exe","bitsadmin.exe","curl","wget","whoami","net.exe","nltest.exe","wscript.exe","cscript.exe")

SELECT QIDNAME(qid) AS event, "sourceip", "username", "Parent Process Name" AS parent, "Process Name" AS child, "Process CommandLine" AS cmdline, starttime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log','Microsoft Sysmon')
AND (LOWER("Parent Process Name") LIKE '%java.exe' OR LOWER("Parent Process Name") LIKE '%ahsaycbs%' OR LOWER("Parent Process Name") LIKE '%tomcat%' OR LOWER("Parent Process Name") LIKE '%catalina%')
AND (LOWER("Process Name") LIKE '%cmd.exe' OR LOWER("Process Name") LIKE '%powershell.exe' OR LOWER("Process Name") LIKE '%pwsh.exe' OR LOWER("Process Name") LIKE '%certutil.exe' OR LOWER("Process Name") LIKE '%bitsadmin.exe' OR LOWER("Process Name") LIKE '%curl.exe' OR LOWER("Process Name") LIKE '%wget.exe' OR LOWER("Process Name") LIKE '%whoami.exe' OR LOWER("Process Name") LIKE '%nltest.exe')
LAST 24 HOURS

_sourceCategory=*windows* OR _sourceCategory=*sysmon*
| json field=_raw "ParentImage", "Image", "CommandLine", "User", "Computer" as parent, child, cmdline, user, host nodrop
| toLowerCase(parent) as parent
| toLowerCase(child) as child
| where (parent matches "*java.exe" or parent matches "*ahsaycbs*" or parent matches "*tomcat*" or parent matches "*catalina*")
| where (child matches "*cmd.exe" or child matches "*powershell.exe" or child matches "*pwsh.exe" or child matches "*certutil.exe" or child matches "*bitsadmin.exe" or child matches "*curl.exe" or child matches "*wget.exe" or child matches "*whoami.exe" or child matches "*nltest.exe" or child matches "*net.exe")
| count by host, user, parent, child, cmdline
| sort by _count

rule ahsaycbs_cve_2026_105134_command_injection {
  meta:
    author = "argus"
    description = "AhsayCBS command injection (CVE-2026-105134) via suspicious child process"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (re.regex($e.principal.process.parent_process.file.full_path, `(?i)(java\.exe|javaw\.exe|ahsaycbs|tomcat|catalina)`))
    (re.regex($e.target.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|certutil\.exe|bitsadmin\.exe|curl|wget|whoami|nltest\.exe|net\.exe)`))
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/java(w)?\.exe|AhsayCBS|tomcat|catalina/i OR ParentBaseFileName=/.*ahsay.*/i
| ImageFileName=/\\(cmd|powershell|pwsh|certutil|bitsadmin|curl|wget|whoami|nltest|net)\.exe$/i
| table([_time, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine])
| sort(_time, order=desc)