Apache ActiveMQ Improper Input Validation (CVE-2026-34197)

let activemq_ports = dynamic([61616, 61617, 8161, 8162, 5672, 1883, 61613]);
let suspiciousPatterns = dynamic(["classInfo", "ExceptionResponse", "../", "%2e%2e", "cmd.exe", "/bin/sh", "powershell", "wget", "curl", "ClassPathXmlApplicationContext"]);
union
(
  CommonSecurityLog
  | where TimeGenerated > ago(24h)
  | where DestinationPort in (activemq_ports) or SourcePort in (activemq_ports)
  | where Message has_any (suspiciousPatterns) or RequestURL has_any (suspiciousPatterns)
  | extend AttackVector = "network_request"
),
(
  DeviceNetworkEvents
  | where TimeGenerated > ago(24h)
  | where RemotePort in (activemq_ports) or LocalPort in (activemq_ports)
  | where InitiatingProcessCommandLine has_any (suspiciousPatterns)
  | extend AttackVector = "process_network"
),
(
  DeviceProcessEvents
  | where TimeGenerated > ago(24h)
  | where ParentProcessName in~ ("activemq.bat", "activemq", "java") or ProcessCommandLine has "activemq"
  | where ProcessCommandLine has_any (["cmd.exe", "powershell", "bash", "sh", "wget", "curl", "nc", "ncat", "/tmp/", "base64"])
  | extend AttackVector = "process_spawn"
)
| project TimeGenerated, AttackVector, DeviceName, AccountName, ProcessCommandLine, RemoteIP, RemotePort, AdditionalFields
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Vectors=make_set(AttackVector) by DeviceName, RemoteIP
| where Count >= 1

index=* sourcetype IN ("cisco:asa", "pan:traffic", "stream:tcp", "xmlwf", "syslog", "WinEventLog:Security", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval activemq_port=if(dest_port IN (61616, 61617, 8161, 8162, 5672, 1883, 61613) OR src_port IN (61616, 61617, 8161, 8162, 5672, 1883, 61613), 1, 0)
| eval suspicious_cmd=if(match(CommandLine, "(?i)(classinfo|ClassPathXmlApplicationContext|ExceptionResponse|cmd\.exe|/bin/sh|powershell|wget|curl|base64|ncat|/tmp/)"), 1, 0)
| eval suspicious_proc=if(match(ParentImage, "(?i)(activemq|java)") AND suspicious_cmd=1, 1, 0)
| where activemq_port=1 OR suspicious_proc=1
| eval attack_vector=case(suspicious_proc=1, "process_spawn", activemq_port=1 AND suspicious_cmd=1, "network_payload", activemq_port=1, "port_contact", true(), "unknown")
| stats count AS event_count, values(attack_vector) AS attack_vectors, min(_time) AS first_seen, max(_time) AS last_seen, values(dest_ip) AS dest_ips, values(CommandLine) AS command_lines BY src_ip, host
| where event_count >= 1
| eval severity="critical"
| sort -event_count

sequence by host.name with maxspan=5m
  [network where event.action in ("connection_attempted", "connection_accepted") and
   (destination.port in (61616, 61617, 8161, 8162, 5672, 1883, 61613) or
    source.port in (61616, 61617, 8161, 8162, 5672, 1883, 61613)) and
   not source.ip in ("127.0.0.1", "::1")]
  [process where event.type == "start" and
   (process.parent.name in ("java", "activemq", "activemq.bat", "wrapper") or
    process.parent.executable like~ "*activemq*") and
   process.name in ("cmd.exe", "powershell.exe", "bash", "sh", "dash", "wget", "curl", "nc", "ncat", "python", "python3", "perl") and
   not process.args_count == 0]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  sourceport,
  username,
  "Application" AS application,
  QIDNAME(qid) AS event_name,
  category,
  logsourcename(logsourceid) AS log_source,
  payload
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Linux OS', 'Palo Alto PA Series', 'Cisco ASA')
  AND (
    destinationport IN (61616, 61617, 8161, 8162, 5672, 1883, 61613)
    OR sourceport IN (61616, 61617, 8161, 8162, 5672, 1883, 61613)
  )
  AND (
    payload ILIKE '%ClassPathXmlApplicationContext%'
    OR payload ILIKE '%classInfo%'
    OR payload ILIKE '%cmd.exe%'
    OR payload ILIKE '%powershell%'
    OR payload ILIKE '%./%..%'
    OR payload ILIKE '%wget%'
    OR payload ILIKE '%curl%'
    OR payload ILIKE '%base64%'
  )
  AND LOGSOURCESTARTTIME(starttime) > NOW() - 86400 SECONDS
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory=*activemq* OR _sourceCategory=*network* OR _sourceCategory=*firewall* OR _sourceCategory=*endpoint*
| where !(src_ip matches "127.0.0.1" or src_ip matches "::1")
| where dest_port in ("61616", "61617", "8161", "8162", "5672", "1883", "61613") or src_port in ("61616", "61617", "8161", "8162", "5672", "1883", "61613")
| parse regex field=_raw "(?<suspicious_string>ClassPathXmlApplicationContext|classInfo|ExceptionResponse|cmd\.exe|powershell|/bin/sh|wget|curl|base64|ncat|\.\./)" nodrop
| where !isNull(suspicious_string) or !isEmpty(suspicious_string)
| timeslice 5m
| stats count as event_count, values(suspicious_string) as indicators, values(src_ip) as source_ips by _timeslice, dest_ip, dest_port, _sourceHost
| where event_count >= 1
| sort by _timeslice desc

rule cve_2026_34197_activemq_exploitation {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-34197 Apache ActiveMQ improper input validation exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt"
    tags = "cve-2026-34197, activemq, cwe-20, cwe-94, kev"

  events:
    (
      // Network event to ActiveMQ ports
      $net.metadata.event_type = "NETWORK_CONNECTION"
      $net.target.port in (61616, 61617, 8161, 8162, 5672, 1883, 61613)
      $net.principal.ip != "127.0.0.1"
      (
        $net.network.http.request_url = /ClassPathXmlApplicationContext/ nocase or
        $net.network.http.request_url = /\.\.\/\.\.\// nocase or
        $net.metadata.description = /classInfo|ExceptionResponse/ nocase
      )
    )
    or
    (
      // Process launched as child of ActiveMQ/Java with suspicious commands
      $proc.metadata.event_type = "PROCESS_LAUNCH"
      $proc.principal.process.file.full_path = /activemq|java/ nocase
      $proc.target.process.file.full_path = /cmd\.exe|powershell|bash|sh|wget|curl|ncat|python/ nocase
    )

  condition:
    $net or $proc
}

#event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6", "ProcessRollup2", "SyntheticProcessRollup2")
| eval activemq_port=if(RemotePort IN ("61616", "61617", "8161", "8162", "5672", "1883", "61613") OR LocalPort IN ("61616", "61617", "8161", "8162", "5672", "1883", "61613"), true(), false())
| eval suspicious_child=if(match(ParentBaseFileName, "(?i)java|activemq") AND match(FileName, "(?i)cmd\.exe|powershell\.exe|bash|sh|wget|curl|nc|ncat|python"), true(), false())
| eval payload_ioc=if(match(CommandLine, "(?i)ClassPathXmlApplicationContext|classInfo|ExceptionResponse|base64|/tmp/|%TEMP%"), true(), false())
| where activemq_port=true() OR suspicious_child=true() OR payload_ioc=true()
| eval attack_signal=case(suspicious_child=true() AND (activemq_port=true() OR payload_ioc=true()), "high_confidence_exploit", suspicious_child=true(), "suspicious_child_process", payload_ioc=true(), "malicious_payload", activemq_port=true(), "port_probe", true(), "unknown")
| stats count() AS event_count, values(RemoteIP) AS remote_ips, values(CommandLine) AS commands, values(attack_signal) AS signals BY ComputerName, UserName, ParentBaseFileName, FileName
| where event_count >= 1
| sort -event_count