CVE-2026-46595: golang.org/x/crypto/ssh VerifiedPublicKeyCallback Authentication Bypass

union isfuzzy=true
(
  // Detect SSH authentication events where public key auth succeeds anomalously
  CommonSecurityLog
  | where DeviceEventClassID has_any ("sshd", "openssh", "ssh")
  | where Message has_any ("Accepted publickey", "publickey authentication", "keyboard-interactive")
  | where DeviceProduct has_any ("go", "golang", "ssh")
  | extend AuthMethod = extract("auth method: ([\\w-]+)", 1, Message)
  | extend Username = extract("for ([\\w]+) from", 1, Message)
  | extend SourceIP = SourceIP
  | project TimeGenerated, SourceIP, DestinationIP, Username, AuthMethod, Message, Computer
),
(
  // Detect Go SSH server processes with unexpected successful auth
  Syslog
  | where Facility == "auth" or SyslogMessage has "sshd"
  | where SyslogMessage has_any ("Accepted", "publickey", "VerifiedPublicKey")
  | extend Username = extract("for ([\\w]+) from", 1, SyslogMessage)
  | extend SourceIP = extract("from ([\\d\.]+)", 1, SyslogMessage)
  | project TimeGenerated, HostName, SourceIP, Username, SyslogMessage
),
(
  // Detect anomalous SSH lateral movement via process telemetry
  DeviceProcessEvents
  | where FileName in~ ("ssh", "sshd") or ProcessCommandLine has "ssh"
  | where InitiatingProcessFileName has_any ("go", "golang") or FolderPath has "golang"
  | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, RemoteIP
)
| where isnotempty(SourceIP) or isnotempty(RemoteIP)
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, Username, Computer, HostName
| where Count >= 1
| extend RiskScore = case(Count > 10, "High", Count > 3, "Medium", "Low")
| sort by LastSeen desc

index=* sourcetype IN ("linux_secure", "syslog", "wineventlog", "osquery")
(
  ("Accepted publickey" OR "publickey" OR "VerifiedPublicKeyCallback" OR "golang" OR "x/crypto/ssh")
  AND ("ssh" OR "sshd")
)
| eval auth_method=case(
    match(_raw, "Accepted publickey"), "publickey",
    match(_raw, "keyboard-interactive"), "keyboard-interactive",
    match(_raw, "password"), "password",
    true(), "unknown"
  )
| eval src_ip=coalesce(src_ip, src, clientip)
| eval username=coalesce(user, username)
| eval dest_host=coalesce(dest_host, host)
| rex field=_raw "from (?P<extracted_src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| eval src_ip=coalesce(src_ip, extracted_src_ip)
| rex field=_raw "for (?P<extracted_user>\w+) from"
| eval username=coalesce(username, extracted_user)
| where auth_method="publickey"
| stats count AS auth_count, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(auth_method) AS auth_methods by src_ip, username, dest_host
| eval risk_score=case(auth_count > 20, "critical", auth_count > 5, "high", auth_count > 1, "medium", true(), "low")
| eval duration_hours=round((last_seen - first_seen) / 3600, 2)
| convert ctime(first_seen) ctime(last_seen)
| sort - auth_count
| table src_ip, username, dest_host, auth_count, auth_methods, risk_score, duration_hours, first_seen, last_seen

sequence by host.name with maxspan=5m
  [authentication where
    event.action in ("ssh_login", "user_login", "authenticated") and
    event.outcome == "success" and
    (
      process.name in ("sshd", "ssh") or
      user_agent.original like~ "*golang*" or
      user_agent.original like~ "*crypto/ssh*"
    ) and
    authentication.type == "publickey"
  ] by source.ip, user.name
  [network where
    network.protocol == "ssh" and
    event.action == "connection_attempted" and
    source.ip != "127.0.0.1"
  ] by source.ip, user.name

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  username,
  QIDNAME(qid) AS event_name,
  category,
  logsourcename(logsourceid) AS log_source,
  "eventcount",
  UTF8(payload) AS raw_payload
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'SolarWinds Orion', 'OpenSSH')
  AND (
    UTF8(payload) ILIKE '%Accepted publickey%'
    OR UTF8(payload) ILIKE '%publickey authentication%'
    OR UTF8(payload) ILIKE '%VerifiedPublicKeyCallback%'
    OR UTF8(payload) ILIKE '%golang.org/x/crypto/ssh%'
  )
  AND category IN (5000, 5001, 5002, 5003)
  AND username IS NOT NULL
  AND username != ''
LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory=linux/auth OR _sourceCategory=syslog OR _sourceCategory=ssh
| where _raw matches /Accepted publickey|publickey authentication|VerifiedPublicKeyCallback|golang.*ssh/
| parse regex "for (?P<username>\w+) from (?P<src_ip>[\d\.]+)" nodrop
| parse regex "Accepted (?P<auth_method>\w+) for" nodrop
| where auth_method = "publickey" or isNull(auth_method)
| timeslice 15m
| count by _timeslice, src_ip, username, _sourceHost
| where _count >= 1
| sort by _count desc
| fields _timeslice, src_ip, username, _sourceHost, _count

rule cve_2026_46595_golang_ssh_auth_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects potential exploitation of CVE-2026-46595 golang.org/x/crypto/ssh VerifiedPublicKeyCallback authentication bypass"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-46595"
    yara_version = "YL2.0"
  events:
    (
      $e1.metadata.event_type = "USER_LOGIN"
      and $e1.extensions.auth.auth_details = /publickey|VerifiedPublicKeyCallback/
      and $e1.extensions.auth.mechanism = "MECHANISM_PUBLIC_KEY"
      and $e1.principal.user.userid != ""
    )
    or
    (
      $e1.metadata.event_type = "NETWORK_CONNECTION"
      and $e1.network.application_protocol = "SSH"
      and $e1.metadata.product_name = /golang|go-crypto|x\/crypto/
      and $e1.principal.ip != "127.0.0.1"
    )
  condition:
    $e1
}

#event_simpleName IN ("UserLogon", "NetworkConnectIP4", "ProcessRollup2", "SyntheticProcessRollup2")
| FileName IN ("sshd", "ssh") OR CommandLine = /golang|x\/crypto\/ssh|VerifiedPublicKeyCallback/
| LogonType IN ("10", "3") OR NetworkConnectIP4.RemotePort = "22"
| UserName != "" AND UserName != "SYSTEM"
| eval auth_indicator = case(
    CommandLine = /publickey/, "publickey_auth",
    FileName = "sshd" AND event_simpleName = "UserLogon", "ssh_logon",
    NetworkConnectIP4.RemotePort = "22", "ssh_network",
    true, "other"
  )
| where auth_indicator != "other"
| stats count() AS event_count, earliest(timestamp) AS first_event, latest(timestamp) AS last_event by RemoteAddressIP4, UserName, ComputerName, auth_indicator
| sort - event_count
| limit 1000