EG Secure Solutions SiteGuard Server Edition OS Command Injection (CVE-2026-106931)

let cmdInjectionPatterns = dynamic([";","|","&&","`","$(","%3B","%7C","%26","wget ","curl ","/bin/sh","/bin/bash","cmd.exe","powershell","nc ","bash -i"]);
union isfuzzy=true
(
W3CIISLog
| where csUriStem has_cs "siteguard" or csUriQuery has_any ("siteguard","sg_")
| where csUriQuery has_any (cmdInjectionPatterns) or csUriStem has_any (cmdInjectionPatterns)
| extend EvidenceField = strcat(csUriStem, "?", csUriQuery)
| project TimeGenerated, SrcIp = cIP, Host = sSiteName, Method = csMethod, EvidenceField, UserAgent = csUserAgent
),
(
Syslog
| where ProcessName has "siteguard" or SyslogMessage has "siteguard"
| where SyslogMessage has_any (cmdInjectionPatterns)
| project TimeGenerated, SrcIp = HostIP, Host = HostName, EvidenceField = SyslogMessage
)

(index=web OR sourcetype="ms:iis:auto" OR sourcetype="access_combined") (uri_path="*siteguard*" OR uri_query="*siteguard*" OR uri_query="*sg_*")
| eval payload=uri_path."?".uri_query
| regex payload="(;|\||&&|`|\$\(|%3B|%7C|%26|wget\s|curl\s|/bin/(sh|bash)|cmd\.exe|powershell|nc\s|bash\s-i)"
| stats count min(_time) as firstTime max(_time) as lastTime values(payload) as payloads by src_ip, dest_host, http_method
| where count > 0

process where event.type == "start" and
  process.parent.name in ("siteguard", "siteguardd", "httpd", "nginx", "apache2", "w3wp.exe") and
  process.name in ("sh", "bash", "dash", "cmd.exe", "powershell.exe", "wget", "curl", "nc", "ncat", "python", "perl")

SELECT sourceip, destinationip, "URL", "User Agent", QIDNAME(qid) AS eventName FROM events WHERE ("URL" ILIKE '%siteguard%' OR "URL" ILIKE '%sg_%') AND ("URL" IMATCHES '.*(;|\||&&|`|\$\(|%3B|%7C|%26|wget |curl |/bin/(sh|bash)|cmd\.exe|powershell|bash -i).*') ORDER BY startTime DESC LAST 24 HOURS

_sourceCategory=*web* ("siteguard" OR "sg_")
| where (uri_query matches /.*(;|\||&&|`|\$\(|%3B|%7C|%26|wget |curl |\/bin\/(sh|bash)|cmd\.exe|powershell|nc |bash -i).*/ or uri_path matches /.*siteguard.*/)
| count by src_ip, dest_host, uri_path, uri_query
| sort by _count

rule siteguard_cve_2026_106931_cmd_injection {
  meta:
    author = "Argus"
    description = "OS command injection against EG Secure SiteGuard Server Edition (CVE-2026-106931)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (re.regex($e.network.http.response_code, ".*") or $e.network.http.method != "")
    re.regex($e.target.url, `(?i)(siteguard|sg_)`)
    re.regex($e.target.url, `(?i)(;|\||&&|` + "`" + `|\$\(|%3B|%7C|%26|wget |curl |/bin/(sh|bash)|cmd\.exe|powershell|nc |bash -i)`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| in(field="ParentBaseFileName", values=["siteguard", "siteguardd", "httpd", "nginx", "apache2", "w3wp.exe"])
| in(field="FileName", values=["sh", "bash", "dash", "cmd.exe", "powershell.exe", "wget", "curl", "nc", "ncat", "python", "perl"])
| groupBy([ComputerName, ParentBaseFileName, FileName, CommandLine])