Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-45579.
Upgrade to ProDetect DIRAC RequestManager eval() Remote Code Execution (CVE-2026-45579) in Microsoft Sentinel
Detects exploitation attempts and successful compromise of DIRAC's RequestManager component via CVE-2026-45579, a CWE-95 (Eval Injection) vulnerability where untrusted RPC input passed to RequestManager is evaluated via Python's eval() function, resulting in unauthenticated or low-privilege remote code execution. Affected DIRAC (pip package) versions are >=6,<8.0.79, >=8.1.0a1,<9.0.22, and >=9.1.0,<9.1.10. A public PoC exists (GHSA-9jpv-c7p4-997x). Detection focuses on anomalous eval-triggering payloads sent to DIRAC RequestManager RPC/DISET endpoints, resulting child process spawns from DIRAC service processes, and post-exploitation artifacts consistent with grid/HPC computing infrastructure compromise.
MITRE ATT&CK
KQL Detection Query
let DiracServiceProcs = dynamic(["RequestManager", "RequestManagerHandler", "dirac-request-manager"]);
DeviceProcessEvents
| where InitiatingProcessCommandLine has_any ("RequestManager", "dirac-service") or InitiatingProcessFileName has_any ("python", "python3")
| where FileName in~ ("sh", "bash", "cmd.exe", "powershell.exe", "wget", "curl", "nc", "python", "python3", "id", "whoami")
| where InitiatingProcessCommandLine has_any ("eval(", "__import__", "os.system", "subprocess", "socket.socket", "/bin/sh", "base64")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated descDetects process creation events spawned from DIRAC RequestManager/service processes where the initiating command line contains Python eval-injection indicators (eval(, __import__, os.system, subprocess, base64) consistent with CVE-2026-45579 exploitation, followed by suspicious child processes such as shells, interpreters, or network tools.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate DIRAC administrators running diagnostic scripts that legitimately call eval() in maintenance tooling
- Automated DIRAC test/CI pipelines exercising RequestManager with benign serialized payloads
- Third-party monitoring agents instrumenting Python processes with similar command-line patterns
Other platforms for CVE-2026-45579
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate DIRAC RequestManager eval() RCE via crafted RPC payload
Expected signal: Process creation event showing python3 (DIRAC RequestManager service) spawning /bin/sh -c "id > /tmp/dirac_poc_out" or equivalent child process with eval-injection command-line markers
- Test 2Simulate reverse shell spawned from DIRAC service process
Expected signal: Bash process with /dev/tcp redirection spawned by a process whose parent command line references RequestManager/dirac-service, plus an outbound TCP connection on port 4444
- Test 3Simulate malicious eval() injection payload execution on Windows lab host
Expected signal: DeviceProcessEvents entry showing python.exe spawning cmd.exe/whoami with a parent command line simulation referencing RequestManager, writing output to a temp file
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-45579 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month