Detect EG Secure Solutions SiteGuard Server Edition OS Command Injection (CVE-2026-106931) in Elastic Security
Detects exploitation of CVE-2026-106931, an OS command injection vulnerability (CWE-78) in EG Secure Solutions SiteGuard Server Edition. SiteGuard is a web application firewall/server security product; the flaw allows an attacker to inject arbitrary operating system commands through unsanitized input processed by the server component, resulting in remote code execution under the context of the SiteGuard/web server process. This CVE is listed in the CISA KEV catalog (BOD 26-04) indicating active in-the-wild exploitation. This detection identifies command-injection payloads in requests to the SiteGuard management/server interface and suspicious child processes spawned by the SiteGuard or web server process.
MITRE ATT&CK
- Tactic
- Initial Access Execution
Elastic Detection Query
process where event.type == "start" and
process.parent.name in ("siteguard", "siteguardd", "httpd", "nginx", "apache2", "w3wp.exe") and
process.name in ("sh", "bash", "dash", "cmd.exe", "powershell.exe", "wget", "curl", "nc", "ncat", "python", "perl")Detects shell, download, or scripting child processes spawned by the SiteGuard daemon or fronting web server, consistent with OS command injection via CVE-2026-106931.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate SiteGuard maintenance scripts invoking shell utilities
- Server management automation launching curl/wget from the web server context
- Backup or monitoring jobs spawned by the web server process
Other platforms for CVE-2026-106931
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Simulated command injection via SiteGuard query string
Expected signal: Web/IIS access log entry for /siteguard/admin with URL-encoded ';id' in the query string
- Test 2 Web server spawns shell child process
Expected signal: Process-start event: parent httpd/nginx/www-data spawning /bin/sh
- Test 3 Remote payload download from server context
Expected signal: Process-start event for curl with parent in the web server context and outbound network connection
References (4)
- https://www.eg-secure.co.jp/siteguard/news/alert-202610-1
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-106931
Response Playbook
Triage
- Confirm the targeted host runs EG Secure Solutions SiteGuard Server Edition and identify its exact version against the vendor advisory (alert-202610-1).
- Extract the full request payload (URL/query/body) and decode any URL-encoded metacharacters to confirm an OS command-injection pattern rather than a benign special character.
- Correlate the source IP against threat intel and determine whether it is an authorized scanner, a known pentest source, or an untrusted external host.
- Pivot to endpoint process telemetry on the SiteGuard host to check whether the web server or SiteGuard process spawned any shell, download, or interpreter child processes around the request time.
Containment
- Isolate or network-segment the affected SiteGuard host to prevent lateral movement and command-and-control callbacks.
- Block the attacker source IP(s) at the perimeter and apply the vendor-supplied patch or mitigation from the SiteGuard advisory immediately.
- Rotate credentials and secrets accessible from the SiteGuard/web server process context, as RCE may have exposed them.
Evidence Collection
- Preserve web server access/error logs, SiteGuard application logs, and syslog covering the suspected exploitation window.
- Capture a memory image and disk/triage collection of the SiteGuard host, including process listings, cron/systemd/service persistence, and recently modified files.
- Export EDR process-tree, network-connection, and file-write telemetry for the SiteGuard and web server processes.
Escalation Criteria
- !Escalate to incident response if a shell, reverse connection, or unexpected child process is confirmed to have been spawned from the SiteGuard/web server process.
- !Escalate if there is evidence of persistence, credential access, or lateral movement from the affected host.
- !Escalate to management/legal if the host handles regulated data or if KEV-mandated remediation timelines (CISA BOD 26-04) are at risk of being missed.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web server and SiteGuard access/error logs showing injection payloads - >
Shell history, spawned process artifacts, and newly created/modified files under the SiteGuard or web root directories - >
New cron jobs, systemd services, or startup entries indicating persistence
Tuning Guidance
Baseline legitimate SiteGuard administrative traffic and known scanner/pentest source IPs, then exclude them. Narrow the metacharacter set to those relevant to the SiteGuard request format if benign parameters frequently contain special characters. Pair the web-log signal with the endpoint process-spawn signal to raise confidence and suppress standalone probe noise.
Hunting Queries
Hunts for SiteGuard requests carrying command-injection metacharacters or download/shell payloads over time.
W3CIISLog | where csUriStem has "siteguard" or csUriQuery has "siteguard" | where csUriQuery has_any (";","|","&&","wget","curl","/bin/sh") | summarize count() by cIP, csUriStem, bin(TimeGenerated, 1h)index=web ("siteguard" OR "sg_") | regex uri_query="(;|\||&&|wget|curl|/bin/sh)" | stats count by src_ip, uri_pathAtomic Red Team Tests
Sends an HTTP request to a lab SiteGuard endpoint with a shell metacharacter and benign command to generate a web-log detection event.
Command
curl -s 'http://siteguard-lab.local/siteguard/admin?param=test%3Bid' -A 'atomic-test-cve-2026-106931'Cleanup
echo 'No cleanup required; request is non-persistent'Expected Telemetry
Web/IIS access log entry for /siteguard/admin with URL-encoded ';id' in the query string
Expected Detection
The kql/spl/qradar_aql/sumo_logic/chronicle_yaral web-log queries match on the injection metacharacters.
Simulates post-injection behavior by having a web-server-context process spawn /bin/sh running a command.
Command
sudo -u www-data /bin/sh -c 'id; uname -a'Cleanup
echo 'No persistence created'Expected Telemetry
Process-start event: parent httpd/nginx/www-data spawning /bin/sh
Expected Detection
The elastic_eql and crowdstrike_cql process-lineage queries match the shell child process.
Simulates attacker downloading a second-stage payload via curl from the web server process context.
Command
sudo -u www-data curl -s -o /tmp/atomic_payload http://127.0.0.1/payload.txtCleanup
rm -f /tmp/atomic_payloadExpected Telemetry
Process-start event for curl with parent in the web server context and outbound network connection
Expected Detection
The elastic_eql and crowdstrike_cql queries match curl spawned by the web server parent process.