CVE-2026-44180: Jupyter Enterprise Gateway ContainerProcessProxy._enforce_prohibited_ids Bypass

let SuspiciousKernelOps = DeviceProcessEvents
| where FileName in~ ("jupyter", "jupyter-enterprise-gateway", "python3", "python")
| where ProcessCommandLine has_any ("enterprise_gateway", "EnterpriseGateway", "ContainerProcessProxy")
| project TimeGenerated, DeviceId, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, FileName;
let NetworkActivity = DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("jupyter", "python3", "python")
| where RemotePort in (8888, 8889, 9001, 9002)
| project TimeGenerated, DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, InitiatingProcessCommandLine;
SuspiciousKernelOps
| join kind=leftouter NetworkActivity on DeviceId, DeviceName
| where ProcessCommandLine has_any ("kernel_id", "--kernel-id", "enforce_prohibited", "prohibited_ids")
   or ProcessCommandLine matches regex @"[?&]kernel[_-]id=[a-zA-Z0-9_\-]{8,}"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, RemoteIP, RemotePort

index=* sourcetype IN ("linux_audit", "osquery", "syslog", "WinEventLog:*")
("enterprise_gateway" OR "EnterpriseGateway" OR "ContainerProcessProxy" OR "jupyter-enterprise-gateway")
| eval suspicious_kernel = if(match(cmdline, "kernel[_-]id=[a-zA-Z0-9_\-]{8,}") OR match(cmdline, "enforce_prohibited") OR match(cmdline, "prohibited_ids"), 1, 0)
| where suspicious_kernel=1
| stats count min(_time) as first_seen max(_time) as last_seen values(cmdline) as commands values(user) as users by host
| where count > 0
| eval risk = case(count > 10, "high", count > 3, "medium", true(), "low")
| table host, users, commands, count, first_seen, last_seen, risk

sequence by host.name with maxspan=5m
  [process where process.name in ("python3", "python", "jupyter") and
   (process.command_line like~ "*enterprise_gateway*" or process.command_line like~ "*ContainerProcessProxy*")]
  [network where process.name in ("python3", "python", "jupyter") and
   destination.port in (8888, 8889, 9001, 9002) and
   network.direction == "outgoing"]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') as event_time, sourceip, destinationip, destinationport, username, "Process Name", "Command"
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Linux OS', 'Microsoft Windows Security Event Log', 'UNIX')
  AND ("Command" ILIKE '%enterprise_gateway%' OR "Command" ILIKE '%ContainerProcessProxy%' OR "Process Name" ILIKE '%jupyter%')
  AND ("Command" ILIKE '%kernel_id%' OR "Command" ILIKE '%prohibited_ids%' OR "Command" ILIKE '%enforce_prohibited%')
LAST 24 HOURS

_sourceCategory=linux/audit OR _sourceCategory=osquery OR _sourceCategory=endpoint
| where (%"process.name" in ("python3", "python", "jupyter") or %"cmdline" matches /enterprise_gateway/)
| where %"cmdline" matches /kernel[_-]id=/ or %"cmdline" matches /ContainerProcessProxy/ or %"cmdline" matches /enforce_prohibited/
| parse field=%"cmdline" "kernel_id=*" as kernel_id nodrop
| count by _sourceHost, %"user", %"process.name", kernel_id
| sort by _count desc

rule cve_2026_44180_jupyter_gateway_bypass {
  meta:
    author = "df00tech"
    description = "Detects CVE-2026-44180 Jupyter Enterprise Gateway ContainerProcessProxy prohibited ID bypass"
    severity = "CRITICAL"
    priority = "HIGH"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /python/ nocase
    (
      $e.principal.process.command_line = /enterprise_gateway/ nocase or
      $e.principal.process.command_line = /ContainerProcessProxy/ nocase or
      $e.principal.process.command_line = /kernel[_\-]id=[a-zA-Z0-9_\-]{8,}/ nocase
    )
  condition:
    $e
}

event_simpleName IN ("ProcessRollup2", "SyntheticProcessRollup2")
| ImageFileName IN ("*python3*", "*python*", "*jupyter*")
| CommandLine IN ("*enterprise_gateway*", "*ContainerProcessProxy*", "*kernel_id=*", "*enforce_prohibited*")
| eval risk = if(match(CommandLine, "kernel[_-]id=[a-zA-Z0-9_\-]{20,}"), "high", "medium")
| stats count by ComputerName, UserName, CommandLine, risk
| sort count desc