CVE-2026-48751: Incus Restricted Project Bypass Leading to Arbitrary Command Execution

union
  (SecurityEvent
   | where EventID in (4688, 4689)
   | where ParentProcessName has_any ("incusd", "incus")
   | where CommandLine has_any ("exec", "shell", "bash", "sh", "/bin/sh", "/bin/bash")
   | project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine, EventID),
  (DeviceProcessEvents
   | where InitiatingProcessFileName has_any ("incusd", "incus")
   | where FileName in~ ("sh", "bash", "python3", "python", "perl", "ruby")
   | where ProcessCommandLine has_any ("exec", "chroot", "nsenter", "unshare")
   | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine)
| where TimeGenerated >= ago(24h)
| extend RiskScore = case(
    ProcessCommandLine has_any ("nsenter", "unshare", "chroot"), 100,
    ProcessCommandLine has "exec", 80,
    50)
| where RiskScore >= 80
| sort by TimeGenerated desc

index=linux OR index=endpoint sourcetype IN ("linux:audit", "auditd", "syslog", "osquery:results")
("incusd" OR "incus")
| eval is_escape_attempt=if(match(cmdline, "(nsenter|unshare|chroot|pivot_root)"), 1, 0)
| eval is_shell_spawn=if(match(process, "^(sh|bash|zsh|fish|python[23]?|perl|ruby)$") AND parent_process IN ("incusd", "incus"), 1, 0)
| eval is_privileged_op=if(match(cmdline, "(--target.*1|--mount|--pid|--net|--uts)"), 1, 0)
| where is_escape_attempt=1 OR (is_shell_spawn=1 AND is_privileged_op=1)
| eval risk_score=case(
    is_escape_attempt=1, 100,
    is_shell_spawn=1 AND is_privileged_op=1, 90,
    is_shell_spawn=1, 60,
    true(), 50)
| where risk_score >= 80
| stats count BY host, user, process, parent_process, cmdline, risk_score, _time
| sort -risk_score, -_time

sequence by host.name with maxspan=2m
  [process where event.type == "start"
   and process.parent.name in ("incusd", "incus")
   and process.name in ("sh", "bash", "zsh", "python3", "python", "perl", "ruby")]
  [process where event.type == "start"
   and process.args : ("nsenter", "unshare", "chroot", "pivot_root", "--target", "--mount", "--pid", "--net")
   and process.parent.name in ("sh", "bash", "zsh", "python3", "python", "perl", "ruby")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "processname",
  "parentprocessname",
  "commandline",
  CASE
    WHEN "commandline" ILIKE '%nsenter%' OR "commandline" ILIKE '%unshare%' OR "commandline" ILIKE '%chroot%' THEN 'NAMESPACE_MANIPULATION'
    WHEN "parentprocessname" ILIKE '%incusd%' AND "processname" IN ('sh','bash','zsh','python3','python','perl') THEN 'SHELL_FROM_INCUSD'
    ELSE 'SUSPICIOUS'
  END AS threat_category
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'AuditD')
  AND (
    ("parentprocessname" ILIKE '%incusd%' OR "parentprocessname" ILIKE '%incus%')
    AND (
      "commandline" ILIKE '%nsenter%'
      OR "commandline" ILIKE '%unshare%'
      OR "commandline" ILIKE '%chroot%'
      OR "commandline" ILIKE '%pivot_root%'
      OR ("processname" IN ('sh','bash','zsh','python3','python','perl','ruby'))
    )
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=linux/audit OR _sourceCategory=endpoint/process
| where (parent_process matches /incusd/ OR parent_process matches /^incus$/)
| where (
    process matches /^(sh|bash|zsh|python3?|perl|ruby)$/
    OR command matches /nsenter|unshare|chroot|pivot_root/
  )
| eval risk = if(command matches /nsenter|unshare|chroot|pivot_root/, "CRITICAL",
           if(process matches /^(sh|bash|zsh|python3?|perl|ruby)$/, "HIGH", "MEDIUM"))
| where risk in ("CRITICAL", "HIGH")
| fields _messageTime, _sourceHost, user, process, parent_process, command, risk
| sort by _messageTime desc
| count by _sourceHost, user, process, parent_process, risk

rule cve_2026_48751_incus_restricted_bypass {
  meta:
    author = "Argus Detection Platform"
    description = "Detects CVE-2026-48751 Incus restricted project bypass exploitation"
    severity = "CRITICAL"
    confidence = "MEDIUM"
    mitre_attack_tactic = "Privilege Escalation, Execution"
    cve = "CVE-2026-48751"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /incusd|incus/
    (
      $proc.target.process.file.full_path = /\/(sh|bash|zsh|python3?|perl|ruby)$/
      or
      $proc.target.process.command_line = /nsenter|unshare|chroot|pivot_root/
    )

  condition:
    $proc
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName IN ("incusd", "incus")
| CommandLine = /(nsenter|unshare|chroot|pivot_root)|FileName IN (sh|bash|zsh|python3|python|perl|ruby)/
| eval ThreatCategory = case(
    CommandLine =~ /nsenter|unshare|chroot|pivot_root/, "NAMESPACE_ESCAPE",
    FileName IN ("sh", "bash", "zsh", "python3", "python", "perl", "ruby"), "SHELL_SPAWN",
    "OTHER"
  )
| where ThreatCategory IN ("NAMESPACE_ESCAPE", "SHELL_SPAWN")
| table _time, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, ThreatCategory
| sort -_time
| limit 200