Incus exec-output Symlink Arbitrary File Write on Host (CVE-2026-48750)

union
(
    DeviceFileEvents
    | where ActionType in ("FileCreated", "FileModified")
    | where InitiatingProcessParentFileName has_any ("incusd", "incus")
    | where FolderPath matches regex @"/(etc|root|var/spool/cron|usr/local/bin|lib/systemd|home/[^/]+/\.ssh)"
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, FolderPath, FileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
),
(
    DeviceProcessEvents
    | where InitiatingProcessParentFileName has_any ("incusd", "incus")
    | where FileName in~ ("ln", "cp", "mv", "install", "tee", "bash", "sh", "python3", "perl")
    | where ProcessCommandLine matches regex @"(exec.output|/var/log/incus|/run/incus)"
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, InitiatingProcessCommandLine
),
(
    Syslog
    | where Facility == "daemon" and ProcessName in ("incusd", "incus")
    | where SyslogMessage has_any ("exec-output", "symlink", "file write", "container escape")
    | project TimeGenerated, HostName, SyslogMessage, ProcessName
)
| extend ThreatLabel = "CVE-2026-48750 Incus symlink exec-output file write"
| order by TimeGenerated desc

index=linux_os OR index=endpoint sourcetype IN ("linux:audit", "syslog", "auditd", "osquery:results")
| eval is_incus_parent = if(match(parent_process, "incusd|incus"), 1, 0)
| eval sensitive_path = if(match(file_path, "^/(etc|root|var/spool/cron|usr/local/bin|lib/systemd|home/[^/]+/\.ssh)"), 1, 0)
| eval exec_output_ref = if(match(command, "exec.output|exec_output"), 1, 0)
| eval symlink_activity = if(match(syscall, "symlink|symlinkat|lstat"), 1, 0)
| where (is_incus_parent=1 AND sensitive_path=1) OR (is_incus_parent=1 AND exec_output_ref=1) OR (symlink_activity=1 AND exec_output_ref=1)
| eval threat_label = "CVE-2026-48750 Incus exec-output symlink host file write"
| table _time, host, user, parent_process, process, command, file_path, syscall, threat_label
| sort - _time

sequence by host.name with maxspan=5m
  [process where process.parent.name in ("incusd", "incus") and
   process.name in ("ln", "cp", "mv", "bash", "sh", "tee", "install") and
   process.command_line : ("*exec*output*", "*exec_output*", "*/var/log/incus*", "*/run/incus*")]
  [file where process.parent.name in ("incusd", "incus") and
   file.path : ("/etc/*", "/root/*", "/var/spool/cron/*", "/usr/local/bin/*", "/lib/systemd/*", "/home/*/.ssh/*") and
   event.action in ("creation", "overwrite")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  "sourceip",
  QIDNAME(qid) AS event_name,
  "File Path" AS file_path,
  "Process Name" AS process_name,
  "Parent Process Name" AS parent_process,
  "Command" AS command_line
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Linux', 'Auditd', 'Syslog')
  AND (
    ("Parent Process Name" ILIKE '%incusd%' OR "Parent Process Name" ILIKE '%incus%')
    AND (
      "File Path" ILIKE '/etc/%' OR
      "File Path" ILIKE '/root/%' OR
      "File Path" ILIKE '/var/spool/cron/%' OR
      "File Path" ILIKE '/usr/local/bin/%' OR
      "File Path" ILIKE '/lib/systemd/%'
    )
  )
  OR (
    ("Parent Process Name" ILIKE '%incusd%' OR "Parent Process Name" ILIKE '%incus%')
    AND ("Command" ILIKE '%exec-output%' OR "Command" ILIKE '%exec_output%')
  )
  OR (
    "Event Category" = 'symlink'
    AND ("Command" ILIKE '%exec-output%' OR "Command" ILIKE '%exec_output%')
  )
LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory=linux/audit OR _sourceCategory=linux/syslog
| parse regex field=_raw "parent_process=(?P<parent_process>[^\s]+)"
| parse regex field=_raw "process=(?P<process>[^\s]+)"
| parse regex field=_raw "file_path=(?P<file_path>[^\s]+)"
| parse regex field=_raw "command=(?P<command>[^\n]+)"
| where (parent_process matches "*incusd*" OR parent_process matches "*incus*")
  AND (
    (file_path matches "/etc/*" OR file_path matches "/root/*" OR file_path matches "/var/spool/cron/*" OR file_path matches "/usr/local/bin/*" OR file_path matches "/lib/systemd/*")
    OR (command matches "*exec-output*" OR command matches "*exec_output*")
  )
| or (command matches "*exec-output*" AND (message matches "*symlink*" OR message matches "*lstat*"))
| fields _messageTime, _sourceHost, parent_process, process, file_path, command
| sort by _messageTime desc

rule incus_exec_output_symlink_host_write {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-48750: Incus exec-output symlink arbitrary file write on host"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/lxc/incus/security/advisories/GHSA-73hr-m85f-64v9"

  events:
    (
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      AND (
        re.regex($e1.principal.process.parent_process.file.full_path, `(incusd|incus)$`)
      )
      AND (
        re.regex($e1.target.process.command_line, `exec.output|exec_output`)
        OR re.regex($e1.target.file.full_path, `^/(etc|root|var/spool/cron|usr/local/bin|lib/systemd)/`)
      )
    )
    OR
    (
      $e1.metadata.event_type = "FILE_CREATION"
      AND re.regex($e1.principal.process.parent_process.file.full_path, `(incusd|incus)$`)
      AND re.regex($e1.target.file.full_path, `^/(etc|root|var/spool/cron|usr/local/bin|lib/systemd|home/[^/]+/\.ssh)/`)
    )

  condition:
    $e1
}

event_simpleName IN (ProcessRollup2, SyntheticProcessRollup2, FileOpenInfo, FileWrittenInfo)
| eval is_incus_parent = if(match(ParentBaseFileName, "incusd|incus"), 1, 0)
| eval sensitive_path = if(match(TargetFileName, "^/(etc|root|var/spool/cron|usr/local/bin|lib/systemd|home/[^/]+/\.ssh)/"), 1, 0)
| eval exec_output_ref = if(match(CommandLine, "exec.output|exec_output"), 1, 0)
| where is_incus_parent=1 AND (sensitive_path=1 OR exec_output_ref=1)
| eval threat = "CVE-2026-48750 Incus exec-output symlink host file write"
| table timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, TargetFileName, threat
| sort - timestamp