GNU InetUtils Argument Injection Vulnerability (CVE-2026-24061)

let InetUtilsBinaries = dynamic(["telnet", "ftp", "rsh", "rcp", "rlogin", "tftp", "ping", "traceroute"]);
DeviceProcessEvents
| where FileName in~ (InetUtilsBinaries) or ProcessCommandLine has_any (InetUtilsBinaries)
| where ProcessCommandLine matches regex @"(?i)(\s-[a-zA-Z]{1,3}\s*=|\\x[0-9a-fA-F]{2}|%0[aAdD]|\\n|\\r|;\s*(bash|sh|nc|curl|wget|python|perl))"
| extend SuspiciousArg = extract(@"(\S*(?:-[a-zA-Z]=|%0[aAdD]|;\s*\S+)\S*)", 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SuspiciousArg, FolderPath
| union (
    Syslog
    | where Facility == "auth" or SyslogMessage has_any (InetUtilsBinaries)
    | where SyslogMessage matches regex @"(?i)(telnet|ftp|rsh|rcp|rlogin).*(-[a-zA-Z]+=|;\s*(bash|sh|nc|curl|wget))"
    | project TimeGenerated, Computer, SyslogMessage
)
| order by TimeGenerated desc

index=* sourcetype IN ("linux_audit", "syslog", "WinEventLog:Security", "xmlwineventlog")
("telnet" OR "ftp" OR "rsh" OR "rcp" OR "rlogin" OR "tftp")
| eval cmd=coalesce(CommandLine, process, message)
| where match(cmd, "(?i)(telnet|ftp|rsh|rcp|rlogin|tftp)")
| where match(cmd, "(?i)(-[a-zA-Z]{1,3}=|%0[aAdD]|\\\\x[0-9a-fA-F]{2}|;\\s*(bash|sh|nc|curl|wget|python|perl)|\\\\n|\\\\r)")
| eval risk_score=case(
    match(cmd, "(?i)(bash|sh|nc|curl|wget|python|perl)"), 90,
    match(cmd, "%0[aAdD]"), 80,
    match(cmd, "-[a-zA-Z]{1,3}="), 60,
    true(), 50
  )
| eval injected_arg=mvindex(split(cmd, " "), 2)
| table _time, host, user, cmd, injected_arg, risk_score
| sort - risk_score, _time

process where event.type == "start"
  and process.name in ("telnet", "ftp", "rsh", "rcp", "rlogin", "tftp", "ping", "traceroute")
  and (
    process.args : ("-*=*", "*%0a*", "*%0d*", "*\\n*", "*\\r*")
    or process.command_line : ("*; bash*", "*; sh*", "*; nc*", "*; curl*", "*; wget*", "*; python*", "*; perl*")
  )

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "Process Name" AS process_name,
  "Command" AS command_line,
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOWER("Process Name") IN ('telnet','ftp','rsh','rcp','rlogin','tftp')
  AND (
    LOWER("Command") MATCHES '.*-[a-z]{1,3}=.*'
    OR LOWER("Command") MATCHES '.*%0[ad].*'
    OR LOWER("Command") MATCHES '.*(;\s*(bash|sh|nc|curl|wget|python|perl)).*'
    OR LOWER("Command") MATCHES '.*(\\\\n|\\\\r).*'
  )
  AND INOFFENSE()
LAST 24 HOURS

_sourceCategory=linux/auditd OR _sourceCategory=syslog OR _sourceCategory=windows/security
| where _raw matches /(?i)(telnet|ftp|rsh|rcp|rlogin|tftp)/
| parse regex field=_raw "(?P<cmd_line>(?:telnet|ftp|rsh|rcp|rlogin|tftp)\\s+[^\\n]+)" nodrop
| where cmd_line matches /(?i)(-[a-zA-Z]{1,3}=|%0[aAdD]|\\\\n|\\\\r|;\\s*(bash|sh|nc|curl|wget|python|perl))/
| eval risk=if(cmd_line matches /(?i)(bash|sh|nc|curl|wget)/, "critical", if(cmd_line matches /%0[aAdD]/, "high", "medium"))
| count by _sourceHost, cmd_line, risk
| order by risk, _count desc

rule cve_2026_24061_inetutils_arg_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects GNU InetUtils argument injection (CVE-2026-24061)"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-24061"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /(?i)(telnet|ftp|rsh|rcp|rlogin|tftp)$/
    (
      $e.principal.process.command_line = /(?i)-[a-zA-Z]{1,3}=/ or
      $e.principal.process.command_line = /(?i)%0[aAdD]/ or
      $e.principal.process.command_line = /(?i);\s*(bash|sh|nc|curl|wget|python|perl)/ or
      $e.principal.process.command_line = /\\n|\\r/
    )

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(telnet|ftp|rsh|rcp|rlogin|tftp)$/
| CommandLine = /(?i)(-[a-zA-Z]{1,3}=|%0[aAdD]|\\n|\\r|;\s*(bash|sh|nc|curl|wget|python|perl))/
| eval InjectionType=case(
    CommandLine =~ /(?i)(bash|sh|nc)/,      "shell_spawn",
    CommandLine =~ /(?i)(curl|wget)/,        "http_exfil",
    CommandLine =~ /%0[aAdD]/,              "newline_injection",
    CommandLine =~ /-[a-zA-Z]{1,3}=/,      "option_injection",
    true(),                                  "unknown"
  )
| table _time, ComputerName, UserName, ImageFileName, CommandLine, InjectionType, ParentProcessId
| sort _time desc