Apache Ranger Command Injection (CVE-2026-28672)

let RangerParents = dynamic(["java","java.exe","ranger-admin","EmbeddedServer"]);
let Shells = dynamic(["bash","sh","dash","zsh","ksh","python","python3","perl","nc","ncat","curl","wget","cmd.exe","powershell.exe"]);
DeviceProcessEvents
| where InitiatingProcessFileName has_any (RangerParents)
    and (InitiatingProcessCommandLine has_any ("ranger", "ranger-admin", "EmbeddedServer", "org.apache.ranger"))
| where FileName has_any (Shells)
| where ProcessCommandLine has_any ("-c", "/dev/tcp", "-e", "base64", "curl", "wget", "bash -i", "$(", "`", ";", "|")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessAccountName
| order by Timestamp desc

index=edr (process_name IN ("bash","sh","dash","zsh","ksh","python","python3","perl","nc","ncat","curl","wget","cmd.exe","powershell.exe")) 
| where (parent_process_name="java" OR parent_process_name="java.exe" OR match(parent_process, "ranger-admin|EmbeddedServer|org.apache.ranger")) 
| where match(process, "(-c|/dev/tcp|-e |base64|bash -i|\\$\\(|`|;|\\|)") 
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, parent_process_name, parent_process, process_name, process 
| convert ctime(firstTime) ctime(lastTime)

process where event.type == "start" and
  process.name in ("bash","sh","dash","zsh","ksh","python","python3","perl","nc","ncat","curl","wget","cmd.exe","powershell.exe") and
  process.parent.name in ("java","java.exe") and
  process.parent.command_line : ("*ranger*","*EmbeddedServer*","*org.apache.ranger*") and
  process.command_line : ("*-c*","*/dev/tcp*","*base64*","*bash -i*","*$(*","*`*","*;*","*|*")

SELECT QIDNAME(qid) AS event, "sourceip", "destinationip", "username", "Process Name" AS process, "Parent Process Name" AS parent, "Process CommandLine" AS cmd, starttime FROM events WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log','Linux OS','Sysmon') AND "Parent Process Name" ILIKE '%java%' AND ("Process CommandLine" ILIKE '%ranger%' OR "Parent Process CommandLine" ILIKE '%org.apache.ranger%') AND "Process Name" IMATCHES '.*(bash|sh|dash|zsh|python|perl|nc|ncat|curl|wget|powershell).*' AND "Process CommandLine" IMATCHES '.*(-c|/dev/tcp|base64|bash -i|\$\(|`|;|\|).*' ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*endpoint* ("bash" OR "sh" OR "python" OR "perl" OR "nc" OR "ncat" OR "curl" OR "wget" OR "powershell") 
| where parent_process_name matches "*java*" 
| where (parent_command_line matches "*ranger*" or parent_command_line matches "*org.apache.ranger*") 
| where process_command_line matches /(-c|\/dev\/tcp|base64|bash -i|\$\(|`|;|\|)/ 
| count by host, user, parent_process_name, process_name, process_command_line

rule ranger_cmd_injection_cve_2026_28672 {
  meta:
    author = "argus"
    description = "Apache Ranger command injection RCE (CVE-2026-28672)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.parent_process.file.full_path = /java/ nocase
    $e.principal.process.parent_process.command_line = /ranger|org\.apache\.ranger|EmbeddedServer/ nocase
    $e.target.process.file.full_path = /(bash|sh|dash|zsh|python|perl|nc|ncat|curl|wget|powershell)/ nocase
    $e.target.process.command_line = /(-c|\/dev\/tcp|base64|bash -i|\$\(|`|;|\|)/
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/java(\.exe)?/i
| ParentCommandLine=/ranger|org\.apache\.ranger|EmbeddedServer/i
| in(field="FileName", values=["bash","sh","dash","zsh","python","python3","perl","nc","ncat","curl","wget","powershell.exe"])
| CommandLine=/(-c|\/dev\/tcp|base64|bash -i|\$\(|`|;|\|)/
| table([_time, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine])