TanStack Router Unspecified Vulnerability Exploitation

let timeWindow = 1h;
let suspiciousRoutePatterns = dynamic(['__proto__', 'constructor', 'prototype', '../', '..\\', '%2e%2e', '%252e', 'javascript:', 'data:text']);
let tanstackApps = SecurityAlert
| where TimeGenerated >= ago(timeWindow)
| where AlertName has_any ('TanStack', 'tanstack-router')
| project AlertTime=TimeGenerated, AlertName, Entities;
W3CIISLog
| where TimeGenerated >= ago(timeWindow)
| where csUriStem has_any (suspiciousRoutePatterns) or csUriQuery has_any (suspiciousRoutePatterns)
| extend DecodedUri = url_decode(csUriStem), DecodedQuery = url_decode(csUriQuery)
| where DecodedUri has_any (suspiciousRoutePatterns) or DecodedQuery has_any (suspiciousRoutePatterns)
| summarize RequestCount=count(), UniqueIPs=dcount(cIP), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), SampleURIs=make_set(csUriStem, 5) by cIP, csHost, csUriStem
| where RequestCount > 5 or UniqueIPs > 3
| extend Severity='High', CVE='CVE-2026-45321'
| union (
    AppServiceHTTPLogs
    | where TimeGenerated >= ago(timeWindow)
    | where CsUriStem has_any (suspiciousRoutePatterns) or CsUriQuery has_any (suspiciousRoutePatterns)
    | summarize RequestCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by CIp, CsHost, CsUriStem
    | extend Severity='High', CVE='CVE-2026-45321'
)

index=web OR index=iis OR index=apache sourcetype IN ("iis", "apache:access", "nginx:access", "aws:cloudfront:accesslogs")
| eval decoded_uri=urldecode(uri_path), decoded_query=urldecode(uri_query)
| where match(decoded_uri, "(__proto__|constructor\\.prototype|\\.\\./|\\.\\.\\\\\.|\\.\\.\\.|\\.\\.\\/)") OR match(decoded_query, "(__proto__|constructor\\.prototype|javascript:|data:text)")
| eval cve="CVE-2026-45321", app_framework="TanStack"
| stats count AS request_count, dc(src_ip) AS unique_sources, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(uri_path) AS sample_paths BY src_ip, dest, http_user_agent
| where request_count > 3
| eval risk_score=case(request_count > 50, 90, request_count > 20, 75, request_count > 5, 60, true(), 40)
| eval severity=case(risk_score >= 75, "critical", risk_score >= 60, "high", true(), "medium")
| table first_seen, last_seen, src_ip, dest, request_count, unique_sources, risk_score, severity, sample_paths, cve
| sort -risk_score

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and network.direction == "inbound"
   and (
     url.path : ("*__proto__*", "*constructor*prototype*", "*%2e%2e*", "*javascript:*")
     or url.query : ("*__proto__*", "*constructor*prototype*", "*data:text*")
   )
  ] with runs=3

SELECT
  sourceip,
  destinationip,
  URL,
  username,
  COUNT(*) AS request_count,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen,
  'CVE-2026-45321' AS cve_id
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'Nginx')
  AND (
    URL ILIKE '%__proto__%'
    OR URL ILIKE '%constructor%prototype%'
    OR URL ILIKE '%javascript:%'
    OR URL ILIKE '%data:text%'
    OR URL ILIKE '%../%'
    OR URL ILIKE '%..\\%'
    OR URL ILIKE '%252e252e%'
  )
  AND DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') > DATEADD('hour', -1, NOW())
GROUP BY sourceip, destinationip, URL, username
HAVING request_count > 3
ORDER BY request_count DESC
LAST 1 HOURS

_sourceCategory=web/* OR _sourceCategory=iis/* OR _sourceCategory=nginx/*
| parse regex "(?<src_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})" nodrop
| parse regex "\"(?<method>GET|POST|PUT|DELETE|PATCH)\s+(?<uri_path>[^\s]+)" nodrop
| urldecode(uri_path) as decoded_path
| where decoded_path matches "*__proto__*" or decoded_path matches "*constructor.prototype*" or decoded_path matches "*../*" or decoded_path matches "*javascript:*" or decoded_path matches "*data:text*"
| count as request_count by src_ip, decoded_path, _sourceHost
| where request_count > 3
| sort by request_count desc
| fields src_ip, decoded_path, _sourceHost, request_count
| concat("CVE-2026-45321 TanStack exploitation attempt from ", src_ip) as alert_message

rule cve_2026_45321_tanstack_exploitation {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation attempts targeting TanStack Router CVE-2026-45321"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx"

  events:
    $request.metadata.event_type = "NETWORK_HTTP"
    $request.principal.ip = $src_ip
    (
      re.regex($request.network.http.request_url, `(__proto__|constructor\.prototype|javascript:|data:text|%2e%2e|%252e)`) or
      re.regex($request.network.http.request_url, `(\.\./|\.\.\\ )`)
    )

  match:
    $src_ip over 5m

  condition:
    #request > 3
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkConnectIP6 OR #event_simpleName=ProcessRollup2
| CommandLine = /(__proto__|constructor\.prototype|javascript:|data:text)/i OR RemotePort IN (80, 443, 8080, 8443)
| eval cve="CVE-2026-45321"
| stats count() AS event_count, values(CommandLine) AS commands, values(RemoteIP) AS remote_ips BY aid, ComputerName, UserName
| search event_count > 2
| eval risk=case(
    CommandLine = /__proto__|constructor\.prototype/, "prototype_pollution",
    CommandLine = /javascript:|data:text/, "injection_attempt",
    true(), "anomalous_routing"
  )
| table ComputerName, UserName, event_count, commands, remote_ips, risk, cve