Apache Tomcat Missing Encryption of Sensitive Data (CVE-2026-34486)

// Detect plaintext access/config-file reads and cleartext HTTP traffic to Tomcat services indicative of CVE-2026-34486 exposure
let TomcatPorts = dynamic([8080,8009,80]);
union isfuzzy=true
(DeviceProcessEvents
| where FileName in~ ("cat","type.exe","more.exe","findstr.exe","grep")
| where ProcessCommandLine has_any ("tomcat-users.xml","server.xml","context.xml","web.xml")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName),
(DeviceNetworkEvents
| where RemotePort in (TomcatPorts)
| where Protocol == "Tcp" and isnotempty(RemoteUrl)
| where RemoteUrl startswith "http://"
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName)
| sort by TimeGenerated desc

index=* sourcetype=tomcat_access OR sourcetype=linux_secure OR sourcetype=wineventlog
| eval is_config_access=if(match(_raw, "(?i)(tomcat-users\.xml|server\.xml|context\.xml|web\.xml)"), 1, 0)
| eval is_cleartext=if(match(_raw, "(?i)http://.*:(8080|8009|80)/"), 1, 0)
| where is_config_access=1 OR is_cleartext=1
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, uri, _raw
| where count > 0

sequence by host.name with maxspan=10m
  [file where event.action == "open" and file.name : ("tomcat-users.xml","server.xml","context.xml","web.xml")]
  [network where destination.port in (8080,8009,80) and network.protocol == "http" and not tls.established == true]

SELECT sourceip, destinationip, destinationport, filename, username, starttime
FROM events
WHERE (filename ILIKE '%tomcat-users.xml%' OR filename ILIKE '%server.xml%' OR filename ILIKE '%context.xml%' OR filename ILIKE '%web.xml%')
   OR (destinationport IN (8080,8009,80) AND applicationprotocol = 'HTTP' AND NOT applicationprotocol = 'HTTPS')
LAST 24 HOURS

_sourceCategory=*tomcat* OR _sourceCategory=*network*
| where (_raw matches "*tomcat-users.xml*" or _raw matches "*server.xml*" or _raw matches "*context.xml*" or _raw matches "*web.xml*")
   or (_raw matches "*http://*:8080/*" or _raw matches "*http://*:8009/*")
| count by host, user, _raw
| where _count > 0

rule cve_2026_34486_tomcat_missing_encryption {
  meta:
    description = "Detects access to sensitive Tomcat config files or cleartext HTTP to Tomcat ports, consistent with CVE-2026-34486"
    severity = "HIGH"
  events:
    $file.metadata.event_type = "FILE_OPEN"
    $file.target.file.full_path = /tomcat-users\.xml|server\.xml|context\.xml|web\.xml/ nocase
    $net.metadata.event_type = "NETWORK_HTTP"
    $net.target.port = 8080 or $net.target.port = 8009 or $net.target.port = 80
    $net.network.tls.established = false
  match:
    $file.principal.hostname = $net.principal.hostname over 10m
  condition:
    $file or $net
}

#event_simple_name=ProcessRollup2 OR #event_simple_name=NetworkConnectIP4
| case {
    #event_simple_name=ProcessRollup2 [ CommandLine=/tomcat-users\.xml|server\.xml|context\.xml|web\.xml/i ];
    #event_simple_name=NetworkConnectIP4 [ RemotePort=8080 OR RemotePort=8009 OR RemotePort=80 ]
  }
| groupBy([ComputerName, UserName], function=([count(aid, as=hits)]))
| filter(hits > 0)