SmarterMail Authentication Bypass via Alternate Path or Channel (CVE-2026-23760)

union isfuzzy=true
(
  W3CIISLog
  | where csUriStem has_any ("/api/", "/autodiscover/", "/ews/", "/mapi/", "/interface/", "/webmail/")
  | where csMethod in ("POST", "GET", "PUT")
  | where scStatus in (200, 201, 302) and (csUriQuery has_any ("bypass", "token=", "auth=", "session=") or csUriStem has_any ("/admin", "/config", "/settings"))
  | where csUserAgent !has "Mozilla" or csUriStem has "/api/v1/"
  | extend TargetResource = strcat(csUriStem, "?", csUriQuery)
  | project TimeGenerated, cIP, csUriStem, csUriQuery, csMethod, scStatus, csUserAgent, TargetResource, _ResourceId
),
(
  DeviceNetworkEvents
  | where RemotePort in (25, 110, 143, 443, 587, 993, 995, 8080, 8443)
  | where InitiatingProcessFileName has_any ("SmarterMail", "MailService", "smtpd")
  | where ActionType == "InboundConnectionAccepted"
  | project TimeGenerated, DeviceName, RemoteIP, RemotePort, LocalPort, InitiatingProcessFileName, InitiatingProcessCommandLine
)
| summarize RequestCount=count(), DistinctURIs=dcount(csUriStem), DistinctPorts=dcount(RemotePort) by bin(TimeGenerated, 5m), cIP, DeviceName
| where RequestCount > 10 or DistinctURIs > 5

index=iis OR index=web sourcetype=iis OR sourcetype=ms:iis:auto
| eval uri_combined = uri_path . "?" . uri_query
| where (uri_path IN ("/api/", "/autodiscover/", "/ews/", "/mapi/", "/webmail/") OR match(uri_path, "(?i)(admin|config|settings|interface)"))
  AND http_method IN ("POST", "GET", "PUT")
  AND status IN ("200", "201", "302")
| eval suspicious_params = if(match(uri_query, "(?i)(bypass|token=|auth=|session=)"), 1, 0)
| eval suspicious_agent = if(NOT match(user_agent, "(?i)mozilla") AND match(uri_path, "/api/"), 1, 0)
| where suspicious_params=1 OR suspicious_agent=1
| bucket _time span=5m
| stats count AS request_count, dc(uri_path) AS distinct_uris, values(uri_path) AS accessed_paths, values(status) AS response_codes BY _time, src_ip, host
| where request_count > 10 OR distinct_uris > 5
| eval risk_score = case(
    request_count > 50, "critical",
    request_count > 20, "high",
    distinct_uris > 8, "high",
    true(), "medium"
  )
| table _time, src_ip, host, request_count, distinct_uris, accessed_paths, response_codes, risk_score
| sort - request_count

sequence by source.ip with maxspan=5m
  [network where event.dataset == "iis.access" and
   url.path : ("/api/*", "/autodiscover/*", "/ews/*", "/mapi/*", "/webmail/*", "*/admin*", "*/config*") and
   http.request.method in ("POST", "GET", "PUT") and
   http.response.status_code in (200, 201, 302) and
   (
     url.query : ("*bypass*", "*token=*", "*auth=*", "*session=*") or
     (not user_agent.original : "*Mozilla*" and url.path : "/api/*")
   )
  ] with runs=5
| where #sequencesCount >= 3

SELECT
  sourceip,
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  URL,
  "HTTP Method" AS http_method,
  "HTTP Response Code" AS response_code,
  "User-Agent" AS user_agent,
  COUNT(*) AS request_count
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) ILIKE '%IIS%'
  AND (
    URL ILIKE '%/api/%'
    OR URL ILIKE '%/autodiscover/%'
    OR URL ILIKE '%/ews/%'
    OR URL ILIKE '%/mapi/%'
    OR URL ILIKE '%/admin%'
    OR URL ILIKE '%/config%'
  )
  AND "HTTP Method" IN ('POST', 'GET', 'PUT')
  AND "HTTP Response Code" IN ('200', '201', '302')
  AND (
    URL ILIKE '%bypass%'
    OR URL ILIKE '%token=%'
    OR URL ILIKE '%auth=%'
    OR ("User-Agent" NOT ILIKE '%Mozilla%' AND URL ILIKE '%/api/%')
  )
  AND LOGSOURCENAME(logsourceid) ILIKE '%SmarterMail%'
GROUP BY sourceip, URL, http_method, response_code, user_agent, event_time
HAVING COUNT(*) > 5
LAST 30 MINUTES

_sourceCategory=iis* OR _sourceCategory=webserver*
| parse regex "(?<src_ip>\d+\.\d+\.\d+\.\d+)\s+\S+\s+\S+\s+\[(?<timestamp>[^\]]+)\]\s+\"(?<method>\w+)\s+(?<uri_path>[^\s\?]+)(?:\?(?<uri_query>[^\s\"]*))?\s+HTTP[^\"]*\"\s+(?<status>\d+)"
| where uri_path matches "*/api/*" or uri_path matches "*/autodiscover/*" or uri_path matches "*/ews/*" or uri_path matches "*/admin*" or uri_path matches "*/config*"
| where method in ("POST","GET","PUT")
| where status in ("200","201","302")
| where (uri_query matches "*bypass*" or uri_query matches "*token=*" or uri_query matches "*auth=*")
| timeslice 5m
| stats count as request_count, count_distinct(uri_path) as distinct_paths, values(uri_path) as paths by _timeslice, src_ip
| where request_count > 10 or distinct_paths > 5
| sort by request_count desc

rule smartermail_auth_bypass_cve_2026_23760 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects SmarterMail authentication bypass attempts via alternate path/channel (CVE-2026-23760)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-23760"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "T1190"

  events:
    $req.metadata.event_type = "NETWORK_HTTP"
    $req.principal.ip = $src_ip
    (
      re.regex($req.target.url, `(?i)/api/|/autodiscover/|/ews/|/mapi/|/webmail/|/admin|/config`) or
      re.regex($req.target.url, `(?i)bypass|token=|auth=|session=`)
    )
    $req.network.http.method in ["POST", "GET", "PUT"]
    $req.network.http.response_code in [200, 201, 302]
    not re.regex($req.network.http.user_agent, `(?i)mozilla`) and
      re.regex($req.target.url, `(?i)/api/`)

  match:
    $src_ip over 5m

  condition:
    #req > 10
}

#event_simpleName=NetworkReceiveAcceptIP4
| TargetPort in (80, 443, 8080, 8443, 25, 587, 993, 995)
| RemoteAddressIP4 != "127.0.0.1"
| join type=inner
  [
    #event_simpleName=ProcessRollup2
    | ImageFileName matches regex "(?i)SmarterMail|MailService|smtpd"
    | select aid, ContextProcessId, ImageFileName, CommandLine
  ]
  key=[aid, TargetProcessId = ContextProcessId]
| stats count(RemoteAddressIP4) as connection_count, dc(TargetPort) as distinct_ports, values(ImageFileName) as mail_processes
  by aid, RemoteAddressIP4, bin(timestamp, 5m)
| where connection_count > 20 or distinct_ports > 3
| join type=inner
  [
    #event_simpleName=DnsRequest
    | DomainName matches regex "(?i)SmarterMail"
    | select aid, DomainName
  ]
  key=[aid]
| select timestamp, aid, RemoteAddressIP4, connection_count, distinct_ports, mail_processes, DomainName