DIRAC RequestManager eval() Remote Code Execution (CVE-2026-45579)

let DiracServiceProcs = dynamic(["RequestManager", "RequestManagerHandler", "dirac-request-manager"]);
DeviceProcessEvents
| where InitiatingProcessCommandLine has_any ("RequestManager", "dirac-service") or InitiatingProcessFileName has_any ("python", "python3")
| where FileName in~ ("sh", "bash", "cmd.exe", "powershell.exe", "wget", "curl", "nc", "python", "python3", "id", "whoami")
| where InitiatingProcessCommandLine has_any ("eval(", "__import__", "os.system", "subprocess", "socket.socket", "/bin/sh", "base64")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc

index=edr OR index=sysmon (Image="*python*" OR ParentImage="*python*")
| eval req_ctx=if(match(ParentCommandLine, "(?i)(RequestManager|dirac-service|dirac-request)"), 1, 0)
| where req_ctx=1
| where match(CommandLine, "(?i)(eval\(|__import__|os\.system|subprocess|socket\.socket|/bin/sh|base64\.b64decode)")
| table _time, host, ParentImage, ParentCommandLine, Image, CommandLine, User
| sort -_time

process where event.type == "start" and
  process.parent.name : ("python", "python3") and
  process.parent.command_line : ("*RequestManager*", "*dirac-service*", "*dirac-request*") and
  process.command_line : ("*eval(*", "*__import__*", "*os.system*", "*subprocess*", "*socket.socket*", "*/bin/sh*", "*base64*")

SELECT DATEFORMAT(devicetime, 'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, username, "Process Command Line" AS cmdline, "Parent Command Line" AS parent_cmdline
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon', 'Linux OS')
AND ("Parent Command Line" ILIKE '%RequestManager%' OR "Parent Command Line" ILIKE '%dirac-service%' OR "Parent Command Line" ILIKE '%dirac-request%')
AND ("Process Command Line" ILIKE '%eval(%' OR "Process Command Line" ILIKE '%__import__%' OR "Process Command Line" ILIKE '%os.system%' OR "Process Command Line" ILIKE '%subprocess%' OR "Process Command Line" ILIKE '%socket.socket%' OR "Process Command Line" ILIKE '%base64%')
LAST 24 HOURS

_sourceCategory=*process* OR _sourceCategory=*sysmon*
| where parent_process_command_line matches "*RequestManager*" or parent_process_command_line matches "*dirac-service*" or parent_process_command_line matches "*dirac-request*"
| where process_command_line matches "*eval(*" or process_command_line matches "*__import__*" or process_command_line matches "*os.system*" or process_command_line matches "*subprocess*" or process_command_line matches "*socket.socket*" or process_command_line matches "*base64*"
| fields _messagetime, hostname, user, parent_process_command_line, process_command_line
| sort -_messagetime

rule dirac_requestmanager_eval_rce_cve_2026_45579 {
  meta:
    author = "df00tech"
    description = "Detects process spawns from DIRAC RequestManager consistent with CVE-2026-45579 eval injection RCE"
    severity = "CRITICAL"
    cve = "CVE-2026-45579"
  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.parent_process.command_line = /(?i)(RequestManager|dirac-service|dirac-request)/
    $proc.principal.process.command_line = /(?i)(eval\(|__import__|os\.system|subprocess|socket\.socket|\/bin\/sh|base64)/
  condition:
    $proc
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName in ("python", "python3")
| ParentCommandLine=/(?i)(RequestManager|dirac-service|dirac-request)/
| CommandLine=/(?i)(eval\(|__import__|os\.system|subprocess|socket\.socket|\/bin\/sh|base64)/
| table([ComputerName, UserName, ParentCommandLine, CommandLine, timestamp])
| sort(timestamp, order=desc)