python-statemachine SCXML <data expr> Eval Injection (CVE-2026-47103)

let vulnerable_import = dynamic(['statemachine', 'python_statemachine', 'StateMachine']);
DeviceProcessEvents
| where FileName in~ ('python.exe', 'python3', 'python3.exe', 'uvicorn', 'gunicorn', 'uwsgi', 'flask', 'fastapi')
    or InitiatingProcessFileName in~ ('python.exe', 'python3', 'python3.exe')
| where ProcessCommandLine has_any ('statemachine', 'scxml', '.scxml')
    or ProcessCommandLine matches regex @'(?i)(eval|exec).*scxml'
| union (
    DeviceFileEvents
    | where FileName endswith '.scxml'
    | where ActionType in ('FileCreated', 'FileModified')
)
| union (
    DeviceNetworkEvents
    | where InitiatingProcessFileName in~ ('python.exe', 'python3', 'python3.exe')
    | where RemotePort !in (80, 443, 8080, 8443)
    | where InitiatingProcessCommandLine has_any ('statemachine', 'scxml')
)
| extend RiskScore = case(
    ProcessCommandLine matches regex @'(?i)(subprocess|os\.system|__import__|exec|eval|base64)', 90,
    ProcessCommandLine has '.scxml', 60,
    40
)
| where RiskScore >= 40
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, RemoteIP, RemotePort, RiskScore
| sort by RiskScore desc, TimeGenerated desc

index=* sourcetype IN ("WinEventLog:Microsoft-Windows-Sysmon/Operational", "linux_secure", "osquery:results", "auditd")
| eval cmd=coalesce(CommandLine, command, cmdline, process)
| eval parent=coalesce(ParentCommandLine, parent_cmdline, parent_process)
| where match(cmd, "(?i)(statemachine|scxml)") OR match(cmd, "(?i)(\.scxml)")
| eval suspicious_pattern=if(
    match(cmd, "(?i)(subprocess\.\w+|os\.system|__import__|exec\s*\(|eval\s*\(|base64\.b64decode)"), 1, 0
  )
| eval scxml_file=if(match(cmd, "(?i)\.scxml"), 1, 0)
| eval network_spawn=if(match(parent, "(?i)(statemachine|scxml)") AND sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" AND EventCode=3, 1, 0)
| eval risk_score=case(
    suspicious_pattern=1, 90,
    scxml_file=1 AND match(cmd, "(?i)(statemachine|python)"), 70,
    scxml_file=1, 50,
    true(), 30
  )
| where risk_score >= 50
| stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as commands values(host) as hosts by risk_score, suspicious_pattern
| sort -risk_score
| eval first_seen=strftime(first_seen, "%Y-%m-%dT%H:%M:%SZ"), last_seen=strftime(last_seen, "%Y-%m-%dT%H:%M:%SZ")

sequence by host.name with maxspan=5m
  [process where event.type == "start"
   and (
     process.name in ("python", "python3", "python3.9", "python3.10", "python3.11", "python3.12")
     or process.parent.name in ("python", "python3")
   )
   and (
     process.command_line like~ "*statemachine*"
     or process.command_line like~ "*.scxml*"
     or process.args_count > 0 and process.command_line like~ "*scxml*"
   )
  ] by process.entity_id
  [any where event.category in ("network", "file")
   and (
     (event.category == "network" and not destination.port in (80, 443, 8080, 8443, 5432, 3306, 6379))
     or (event.category == "file" and file.extension == "scxml")
   )
  ] by process.entity_id

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "sourceip",
  "destinationip",
  "destinationport",
  "username",
  "Command" AS command_line,
  QIDNAME(qid) AS event_name,
  CATEGORYNAME(category) AS category_name
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Linux OS', 'Sysmon')
  AND (
    "Command" ILIKE '%statemachine%'
    OR "Command" ILIKE '%.scxml%'
    OR "Command" ILIKE '%scxml%'
  )
  AND (
    "Command" ILIKE '%eval(%'
    OR "Command" ILIKE '%exec(%'
    OR "Command" ILIKE '%__import__%'
    OR "Command" ILIKE '%subprocess%'
    OR "Command" ILIKE '%os.system%'
    OR "Command" ILIKE '%base64%'
    OR "destinationport" NOT IN (80, 443, 8080, 8443)
  )
  AND LOGSOURCETYPENAME(devicetype) NOT ILIKE '%firewall%'
LAST 24 HOURS
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=* ("statemachine" OR ".scxml" OR "scxml")
| parse regex field=_raw "(?P<command_line>(?:python|python3)[^\n]{0,500})"
| where !isNull(command_line)
| eval suspicious=if(
    command_line matches "(?i).*(eval\\(|exec\\(|__import__|subprocess|os\.system|base64\.b64decode).*",
    true, false
  )
| eval scxml_ref=if(command_line matches "(?i).*(\.scxml|scxml).*", true, false)
| eval statemachine_ref=if(command_line matches "(?i).*(statemachine).*", true, false)
| eval risk=if(suspicious and (scxml_ref or statemachine_ref), "CRITICAL",
           if(scxml_ref and statemachine_ref, "HIGH",
           if(scxml_ref or statemachine_ref, "MEDIUM", "LOW")))
| where risk in ("CRITICAL", "HIGH")
| count by _sourceHost, risk, suspicious, command_line
| sort by risk asc, _count desc

rule cve_2026_47103_python_statemachine_eval_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-47103: python-statemachine SCXML eval injection"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/fgmacedo/python-statemachine/security/advisories/GHSA-v4jc-pm6r-3vj8"
    version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /python(3(\.[0-9]+)?)?(\.exe)?$/
    (
      $e.target.process.command_line = /statemachine/
      or $e.target.process.command_line = /\.scxml/
      or $e.target.process.command_line = /scxml/
    )
    (
      $e.target.process.command_line = /eval\s*\(/
      or $e.target.process.command_line = /exec\s*\(/
      or $e.target.process.command_line = /__import__/
      or $e.target.process.command_line = /subprocess/
      or $e.target.process.command_line = /os\.system/
      or $e.target.process.command_line = /base64\.b64decode/
    )
    $hostname = $e.principal.hostname

  match:
    $hostname over 5m

  outcome:
    $risk_score = max(if(
      $e.target.process.command_line = /eval\s*\(/ or
      $e.target.process.command_line = /__import__/, 95, 75
    ))
    $command = array_distinct($e.target.process.command_line)

  condition:
    #e > 0
}

#event_simpleName IN (ProcessRollup2, SyntheticProcessRollup2)
| CommandLine = /(?i)(statemachine|\.scxml|scxml)/
| eval dangerous_eval = if(
    CommandLine = /(?i)(eval\s*\(|exec\s*\(|__import__|subprocess\.|os\.system|base64\.b64decode)/,
    1, 0
  )
| eval scxml_file = if(CommandLine = /(?i)\.scxml/, 1, 0)
| eval statemachine_lib = if(CommandLine = /(?i)statemachine/, 1, 0)
| eval risk_score = case(
    dangerous_eval = 1 AND statemachine_lib = 1, 95,
    dangerous_eval = 1 AND scxml_file = 1, 90,
    statemachine_lib = 1 AND scxml_file = 1, 70,
    dangerous_eval = 1, 60,
    true, 40
  )
| where risk_score >= 60
| eval FileName = FileName + " (" + SHA256HashData + ")"
| table _time, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, risk_score, dangerous_eval
| sort -risk_score, -_time
| head 200