CVE-2026-47391: PraisonAI Unauthenticated A2A LLM eval() Remote Code Execution

union DeviceNetworkEvents, DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where (ActionType == "InboundConnectionAccepted" and LocalPort in (8000, 8080, 5000, 7860) and RemoteIPType != "Private")
   or (FileName in~ ("python.exe", "python3", "python") and ProcessCommandLine has_any ("praisonai", "praison", "a2a"))
| extend SuspiciousEval = iff(ProcessCommandLine has "eval(" or ProcessCommandLine has "exec(", true, false)
| where SuspiciousEval == true or ActionType == "InboundConnectionAccepted"
| project TimeGenerated, DeviceName, AccountName, ActionType, ProcessCommandLine, RemoteIP, LocalPort, FileName
| order by TimeGenerated desc

index=* sourcetype IN ("linux_audit", "WinEventLog:Security", "stream:http", "sysmon", "osquery:results")
| eval is_praison_process=if(match(process, "(?i)praisonai|praison") OR match(cmdline, "(?i)praisonai|a2a"), 1, 0)
| eval has_eval=if(match(cmdline, "eval\\s*\\(") OR match(cmdline, "exec\\s*\\("), 1, 0)
| eval is_web_request=if(sourcetype="stream:http" AND (dest_port IN (8000, 8080, 5000, 7860)) AND NOT cidrmatch("10.0.0.0/8", src_ip) AND NOT cidrmatch("172.16.0.0/12", src_ip) AND NOT cidrmatch("192.168.0.0/16", src_ip), 1, 0)
| where is_praison_process=1 OR has_eval=1 OR is_web_request=1
| stats count by _time, host, src_ip, dest_port, cmdline, process, user
| sort -_time

sequence by host.name with maxspan=2m
  [network where network.direction == "ingress"
   and destination.port in (8000, 8080, 5000, 7860)
   and not source.ip like "10.*" and not source.ip like "192.168.*" and not source.ip like "172.16.*"]
  [process where process.name like~ "python*"
   and (
     process.command_line like "*praisonai*"
     or process.command_line like "*praison*"
     or process.command_line like "*a2a*"
   )
   and (
     process.command_line like "*eval(*"
     or process.command_line like "*exec(*"
     or process.command_line like "*subprocess*"
   )
  ]

SELECT DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') as EventTime, sourceip, destinationip, destinationport, username, "processname", "commandline", QIDNAME(qid) as EventName FROM events WHERE LOGSOURCETYPENAME(devicetype) IN ('Linux','WindowsAuthServer','Sysmon') AND ((destinationport IN (8000,8080,5000,7860) AND sourceip NOT INCIDR '10.0.0.0/8' AND sourceip NOT INCIDR '172.16.0.0/12' AND sourceip NOT INCIDR '192.168.0.0/16') OR ("processname" ILIKE '%python%' AND ("commandline" ILIKE '%praisonai%' OR "commandline" ILIKE '%a2a%') AND ("commandline" ILIKE '%eval(%' OR "commandline" ILIKE '%exec(%'))) LAST 7 DAYS ORDER BY starttime DESC

_sourceCategory=* ("praisonai" OR "praison" OR "a2a")
| parse regex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| parse regex "port[=:\s]+(?<dest_port>\d{2,5})" nodrop
| parse regex "(?<cmd_line>eval\s*\([^)]{0,200}\)|exec\s*\([^)]{0,200}\))" nodrop
| where !isNull(cmd_line) or dest_port in ("8000","8080","5000","7860")
| where isNull(src_ip) or !(src_ip matches "10.*" or src_ip matches "192.168.*" or src_ip matches "172.16.*")
| count by _sourceHost, src_ip, dest_port, cmd_line
| sort by _count desc

rule cve_2026_47391_praisonai_a2a_rce {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation of CVE-2026-47391 PraisonAI unauthenticated A2A LLM eval() RCE"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-vg22-4gmj-prxw"
  events:
    (
      $net.metadata.event_type = "NETWORK_CONNECTION"
      and $net.target.port in (8000, 8080, 5000, 7860)
      and not net.ip_in_range_cidr($net.principal.ip, "10.0.0.0/8")
      and not net.ip_in_range_cidr($net.principal.ip, "172.16.0.0/12")
      and not net.ip_in_range_cidr($net.principal.ip, "192.168.0.0/16")
    )
    or
    (
      $proc.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($proc.target.process.command_line, `(?i)python.*praisonai|praison.*a2a`)
      and re.regex($proc.target.process.command_line, `eval\s*\(|exec\s*\(`)
    )
  condition:
    $net or $proc
}

#event_simpleName IN (NetworkListenIP4, NetworkReceiveAcceptIP4, ProcessRollup2)
| filePath MATCH "(?i)python"
| CommandLine MATCH "(?i)(praisonai|praison|a2a)"
| CommandLine MATCH "(eval\s*\(|exec\s*\()"
| RemoteAddressIP4 != "10.*" AND RemoteAddressIP4 != "172.16.*" AND RemoteAddressIP4 != "192.168.*"
| RemotePort IN [8000, 8080, 5000, 7860]
| table([ _time, aid, ComputerName, UserName, CommandLine, RemoteAddressIP4, RemotePort, FilePath ])
| sort -_time