CVE-2026-44179: XWiki Pro Macros RCE via Excerpt-Include Macro

union DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents
| where TimeGenerated >= ago(24h)
| where (
    (ActionType == "ProcessCreated" and InitiatingProcessParentFileName has_any ("java", "xwiki") and FileName in~ ("bash", "sh", "cmd.exe", "powershell.exe", "whoami", "id", "curl", "wget", "nc", "ncat"))
    or
    (ActionType == "NetworkConnectionSuccess" and InitiatingProcessParentFileName has_any ("java", "xwiki") and RemotePort in (4444, 1337, 9001, 8888))
    or
    (ActionType == "FileCreated" and InitiatingProcessFileName has_any ("java") and FolderPath has_any ("/xwiki", "xwiki-data", "XWiki"))
)
| extend RiskIndicator = case(
    ActionType == "ProcessCreated" and FileName in~ ("bash", "sh", "cmd.exe", "powershell.exe"), "Shell spawned from Java/XWiki process",
    ActionType == "NetworkConnectionSuccess" and RemotePort in (4444, 1337, 9001, 8888), "Reverse shell outbound connection from XWiki JVM",
    ActionType == "FileCreated" and FolderPath has_any ("/xwiki", "xwiki-data"), "File written by XWiki JVM process",
    "Suspicious XWiki JVM activity"
)
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, RemoteIP, RemotePort, InitiatingProcessParentFileName, InitiatingProcessCommandLine, RiskIndicator
| order by TimeGenerated desc

index=* sourcetype IN ("linux_audit", "wineventlog", "sysmon", "osquery", "crowdstrike:events:sensor")
| eval is_xwiki_parent = if(match(parent_process_name, "(?i)(java|xwiki)") OR match(ParentProcessName, "(?i)(java|xwiki)"), 1, 0)
| eval suspicious_child = if(match(process_name, "(?i)(bash|sh|cmd\.exe|powershell\.exe|whoami|id|curl|wget|nc|ncat|python|perl|ruby)") OR match(ProcessName, "(?i)(bash|sh|cmd\.exe|powershell\.exe|whoami|id|curl|wget|nc|ncat)"), 1, 0)
| eval reverse_shell_port = if(dest_port IN ("4444", "1337", "9001", "8888", "443", "80") AND (match(process_name, "(?i)java") OR match(app, "(?i)xwiki")), 1, 0)
| eval xwiki_file_write = if(match(file_path, "(?i)(xwiki|xwiki-data|XWikiStore)") AND match(process_name, "(?i)java"), 1, 0)
| where is_xwiki_parent=1 AND (suspicious_child=1 OR reverse_shell_port=1 OR xwiki_file_write=1)
| eval risk_score = case(
    suspicious_child=1 AND is_xwiki_parent=1, 90,
    reverse_shell_port=1, 80,
    xwiki_file_write=1, 60,
    true(), 50
  )
| eval risk_indicator = case(
    suspicious_child=1, "Shell or interpreter spawned from XWiki/Java process",
    reverse_shell_port=1, "Outbound connection on high-risk port from XWiki JVM",
    xwiki_file_write=1, "File written to XWiki directory by Java process",
    true(), "Suspicious XWiki JVM activity"
  )
| table _time, host, user, process_name, parent_process_name, command_line, dest, dest_port, file_path, risk_score, risk_indicator
| sort -risk_score

sequence by host.name with maxspan=5m
  [process where event.type == "start"
    and (process.parent.name : ("java", "java.exe") or process.parent.executable : ("*/xwiki/*", "*\\xwiki\\*"))
    and process.name : ("bash", "sh", "dash", "zsh", "cmd.exe", "powershell.exe", "whoami", "id", "curl", "wget", "nc", "ncat", "python*", "perl", "ruby")
  ] by process.parent.pid
  [any where event.category : ("network", "file")
    and (
      (event.category == "network" and destination.port in (4444, 1337, 9001, 8888) and network.direction == "egress")
      or
      (event.category == "file" and event.type == "creation" and file.path : ("*/xwiki-data/*", "*/XWiki/*", "*xwiki*"))
    )
  ] by process.pid

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  sourceip,
  destinationip,
  destinationport,
  username,
  QIDNAME(qid) AS event_name,
  "Process Name" AS process_name,
  "Parent Process Name" AS parent_process_name,
  "Command Line" AS command_line,
  magnitude
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Microsoft Windows', 'Sysmon', 'CrowdStrike Falcon')
  AND (
    (
      ("Parent Process Name" ILIKE '%java%' OR "Parent Process Name" ILIKE '%xwiki%')
      AND "Process Name" ILIKE ANY ('%bash%', '%/sh%', '%cmd.exe%', '%powershell%', '%whoami%', '%wget%', '%curl%', '%nc%')
    )
    OR
    (
      (logsourcename(logsourceid) ILIKE '%xwiki%' OR username ILIKE '%xwiki%')
      AND destinationport IN (4444, 1337, 9001, 8888)
      AND category = 1002
    )
  )
  AND starttime > NOW() - 24 HOURS
ORDER BY magnitude DESC
LIMIT 200

_sourceCategory=* ("java" OR "xwiki")
| parse regex field=_raw "(?<parent_process>java|xwiki)[^\n]*?(?<child_process>bash|sh|cmd\.exe|powershell\.exe|whoami|id|curl|wget|nc|ncat|python|perl)" nodrop
| parse regex field=_raw "(?<dest_port>4444|1337|9001|8888)" nodrop
| parse regex field=_raw "(?<xwiki_path>xwiki-data|XWikiStore|xwiki/data)[^\s]*" nodrop
| where !isNull(child_process) OR !isNull(dest_port) OR !isNull(xwiki_path)
| eval risk_indicator = if(!isNull(child_process), "Shell spawned from XWiki JVM: " + child_process,
    if(!isNull(dest_port), "Outbound connection on port " + dest_port + " from XWiki context",
    "XWiki data path access: " + xwiki_path))
| eval severity = if(!isNull(child_process), "CRITICAL",
    if(!isNull(dest_port), "HIGH", "MEDIUM"))
| count by _sourceHost, risk_indicator, severity
| sort by severity, _count desc

rule xwiki_pro_macros_rce_cve_2026_44179 {
  meta:
    author = "df00tech detection engineering"
    description = "Detects RCE exploitation of CVE-2026-44179 in xwiki-pro-macros via excerpt-include macro SSTI"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx"
    mitre_attack_tactic = "Execution"
    mitre_attack_technique = "T1059"

  events:
    (
      $proc.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($proc.principal.process.file.full_path, `(?i)(java|xwiki)`)
      and re.regex($proc.target.process.file.full_path, `(?i)(bash|/sh|dash|zsh|cmd\.exe|powershell\.exe|whoami|wget|curl|ncat|nc\.exe|python)`)
    )
    or
    (
      $proc.metadata.event_type = "NETWORK_CONNECTION"
      and re.regex($proc.principal.process.file.full_path, `(?i)(java|xwiki)`)
      and $proc.target.port in (4444, 1337, 9001, 8888)
      and $proc.network.direction = "OUTBOUND"
    )

  condition:
    $proc
}

#repo=base_activities
| event_type=ProcessRollup2
| ParentBaseFileName in ("java", "java.exe")
| ImageFileName in ("bash", "sh", "dash", "zsh", "cmd.exe", "powershell.exe", "whoami", "id", "curl", "wget", "nc", "ncat", "python3", "python", "perl")
| CommandLine != null
| eval risk = "CVE-2026-44179: Shell spawned from Java/XWiki process"
| select timestamp, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, ImageFileName, CommandLine, risk
| sort timestamp desc
| limit 500

// Alternative network-based pivot:
// #repo=base_activities event_type=NetworkConnectIP4
// | RemotePort in [4444, 1337, 9001, 8888]
// | LocalAddressIP4 != "127.0.0.1"
// | LocalPort > 1024
// | [search process_name in ("java", "java.exe")]
// | select timestamp, ComputerName, UserName, LocalAddressIP4, RemoteAddressIP4, RemotePort