Ubiquiti UniFi OS Path Traversal Exploitation Attempt

union CommonSecurityLog, W3CIISLog
| where TimeGenerated >= ago(7d)
| where RequestURL has_any ("../", "..%2F", "..%5C", "%2e%2e%2f", "%2e%2e/", "..%252f", ".%2e/", "%2e./")
   or RequestURL matches regex @"(\.{2}[/\\]){2,}"
| where DeviceVendor has_any ("Ubiquiti", "UniFi") or ApplicationProtocol has_any ("HTTPS", "HTTP")
| where DestinationPort in (443, 80, 8080, 8443)
| extend DecodedURL = url_decode(RequestURL)
| where DecodedURL has_any ("../", "/etc/passwd", "/etc/shadow", "/proc/", "/var/log", "/data/unifi")
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, DecodedURL, RequestMethod, ResponseCode, DeviceVendor, DeviceProduct
| summarize AttemptCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), URLSamples = make_set(DecodedURL, 5) by SourceIP, DestinationIP, DestinationPort
| where AttemptCount >= 1
| order by AttemptCount desc

index=network OR index=proxy OR index=ids sourcetype IN ("cisco:asa", "pan:traffic", "stream:http", "suricata", "zeek:http", "nginx:access", "iis")
| eval decoded_uri=urldecode(uri)
| where match(uri, "(\.\.\/|\.\.%2[Ff]|\.\.%5[Cc]|%2[Ee]%2[Ee]|%252[Ff])")
   OR match(decoded_uri, "(\.\./){2,}")
   OR match(decoded_uri, "(/etc/passwd|/etc/shadow|/proc/|/var/log|/data/unifi|/opt/unifi)")
| eval dest_port=coalesce(dest_port, dpt)
| where dest_port IN (80, 443, 8080, 8443)
| stats count AS attempt_count, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(decoded_uri) AS url_samples BY src_ip, dest_ip, dest_port
| where attempt_count >= 1
| eval severity="critical"
| sort -attempt_count

sequence by source.ip with maxspan=10m
  [network where event.category == "network" and
   destination.port in (80, 443, 8080, 8443) and
   (
     url.original like "*../*" or
     url.original like "*..%2F*" or
     url.original like "*..%5C*" or
     url.original like "*%2e%2e%2f*" or
     url.original like "*%252f*"
   )]
  [network where event.category == "network" and
   destination.port in (80, 443, 8080, 8443) and
   http.response.status_code in (200, 201, 301, 302)]

SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  "Event Name",
  COUNT(*) AS attempt_count,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen
FROM events
WHERE
  devicetype IN (SELECT id FROM devicetypes WHERE name ILIKE '%proxy%' OR name ILIKE '%firewall%' OR name ILIKE '%ids%')
  AND destinationport IN (80, 443, 8080, 8443)
  AND (
    URL ILIKE '%../%'
    OR URL ILIKE '%..%2F%'
    OR URL ILIKE '%..%5C%'
    OR URL ILIKE '%2e%2e%2f%'
    OR URL ILIKE '%252f%'
    OR URL ILIKE '%2e%2e/%'
  )
  AND LOGSOURCETIME(starttime) > NOW() - 7 DAYS
GROUP BY sourceip, destinationip, destinationport, URL, username, "Event Name"
ORDER BY attempt_count DESC
LAST 7 DAYS

_sourceCategory=network/proxy OR _sourceCategory=network/ids OR _sourceCategory=firewall
| parse "* * * *" as src_ip, dest_ip, dest_port, url nodrop
| urldecode(url) as decoded_url
| where dest_port in ("80", "443", "8080", "8443")
| where url matches "*../*" or url matches "*..%2F*" or url matches "*..%5C*"
   or url matches "*%2e%2e%2f*" or url matches "*%252f*"
   or decoded_url matches "*../../../*"
   or decoded_url matches "*/etc/passwd*"
   or decoded_url matches "*/data/unifi*"
| count as attempt_count by src_ip, dest_ip, dest_port, url, decoded_url
| sort by attempt_count desc

rule cve_2026_34909_unifi_path_traversal {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects path traversal exploitation attempts against Ubiquiti UniFi OS (CVE-2026-34909)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-34909"
    tags = "cve-2026-34909, path-traversal, unifi, ubiquiti, kev"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method != ""
    $e.target.port in (80, 443, 8080, 8443)
    (
      re.regex($e.network.http.request_url, `(\.{2}[\/]|\.\.%2[Ff]|\.\.%5[Cc]|%2[Ee]%2[Ee]%2[Ff]|%252[Ff])`) or
      re.regex($e.network.http.request_url, `(%2e%2e|%252e%252e)`) or
      re.regex($e.network.http.request_url, `(etc/passwd|etc/shadow|data/unifi|opt/unifi|proc/self)`) nocase
    )
  condition:
    $e
}

#event_simpleName=NetworkReceiveAcceptIPv4 OR #event_simpleName=NetworkReceiveAcceptIPv6
| RemotePort in (80, 443, 8080, 8443)
| HttpPath = *../* OR HttpPath = *..%2F* OR HttpPath = *..%5C* OR HttpPath = *%2e%2e%2f* OR HttpPath = *%252f*
   OR HttpPath = */etc/passwd* OR HttpPath = */data/unifi* OR HttpPath = */proc/self*
| eval TraversalDetected = if(isnotnull(HttpPath), "true", "false")
| stats count() as AttemptCount, earliest(timestamp) as FirstSeen, latest(timestamp) as LastSeen, values(HttpPath) as PathSamples by RemoteAddressIP4, LocalAddressIP4, RemotePort, TraversalDetected
| where AttemptCount >= 1
| sort -AttemptCount