Incus Arbitrary File Read/Write via Malicious Image Template Symlink

union isfuzzy=true
(
    SecurityEvent
    | where EventID in (4663, 4656)
    | where ObjectName matches regex @"(?i)(templates[\\/]|/var/lib/incus/|/var/snap/incus/)" 
    | where ObjectName matches regex @"(?i)(\.\./|\\\.\.\\)"
    | project TimeGenerated, Computer, Account, ObjectName, ProcessName, EventID
),
(
    AuditLogs
    | where OperationName =~ "incusd"
    | where ResultDescription has_any ("symlink", "templates", "path traversal")
    | project TimeGenerated, OperationName, ResultDescription, InitiatedBy
),
(
    Syslog
    | where ProcessName =~ "incusd" or ProcessName =~ "incus"
    | where SyslogMessage has_any ("templates/", "symlink", "path escape", "chroot", "container image")
    | where SyslogMessage has_any ("error", "warn", "failed", "denied")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage, HostName
)
| extend AlertName = "CVE-2026-48752 - Incus Malicious Template Symlink"
| order by TimeGenerated desc

index=os OR index=auditd OR index=syslog
(source="/var/log/syslog" OR source="/var/log/daemon.log" OR sourcetype="linux_audit")
(
    (process_name="incusd" OR process_name="incus")
    AND (
        (message="*templates/*" AND (message="*symlink*" OR message="*readlink*" OR message="*lstat*"))
        OR (message="*path escape*" OR message="*container image*" OR message="*chroot escape*")
        OR (file_path="*/var/lib/incus/images/*" AND (message="*../../../*" OR message="*..\\..\\*"))
    )
)
OR (
    sourcetype="linux_audit"
    AND syscall IN ("readlink", "lstat", "open", "openat", "symlinkat")
    AND exe="*/incusd"
    AND (key="container_escape" OR filepath="*templates/*")
)
| eval alert_name="CVE-2026-48752 - Incus Template Symlink Traversal"
| eval severity="critical"
| table _time, host, process_name, file_path, message, syscall, exe, alert_name, severity
| sort -_time

sequence by host.name with maxspan=5m
  [process where process.name == "incusd" and
   (
     process.args : ["*templates/*", "*image import*", "*container create*"]
   )
  ] by process.pid
  [file where process.name == "incusd" and
   (
     file.path : ["/var/lib/incus/*", "/var/snap/incus/*"] and
     (
       file.path : ["*../../../*", "*templates/../*"] or
       file.Ext.original.path : ["*templates/*"]
     )
   ) or
   (
     event.category == "file" and
     event.type == "creation" and
     file.path : ["/etc/*", "/root/*", "/home/*", "/proc/*"] and
     process.name == "incusd"
   )
  ] by process.pid

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
    sourceip,
    username,
    "devicehostname" AS hostname,
    "filename" AS affected_file,
    "filepath" AS affected_path,
    CATEGORYNAME(category) AS event_category,
    "Process Name" AS process_name,
    UTF8(payload) AS raw_payload
FROM events
WHERE
    LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Linux Audit', 'Syslog')
    AND (
        ("Process Name" IMATCHES '(?i)incusd?'
         AND (
             "filename" IMATCHES '(?i)templates[/\\\\]'
             OR "filepath" IMATCHES '(?i)\.\.[/\\\\]'
             OR UTF8(payload) IMATCHES '(?i)(symlink|path.escape|container.image|chroot)'
         ))
        OR
        ("Process Name" IMATCHES '(?i)incusd?'
         AND "filepath" IMATCHES '(?i)(/etc/|/root/|/proc/|/sys/)'
         AND category IN (18, 19))
    )
    AND starttime > NOW() - 1 HOURS
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=linux/syslog OR _sourceCategory=linux/audit OR _sourceCategory=containers/incus
| where _raw matches "(?i)incusd"
| where (
    (_raw matches "(?i)templates/" and _raw matches "(?i)(symlink|readlink|lstat|open)")
    or _raw matches "(?i)(path escape|chroot escape|container image import)"
    or (_raw matches "(?i)incusd" and _raw matches "(?i)(/etc/|/root/|/proc/|/sys/)")
  )
| parse regex "(?P<timestamp>\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2})"
| parse regex "pid=(?P<pid>\\d+)" nodrop
| parse regex "file=(?P<file_path>[^\\s]+)" nodrop
| count by _sourceHost, file_path, _raw
| sort by _count desc
| fields _sourceHost, file_path, _count, _raw

rule cve_2026_48752_incus_template_symlink {
  meta:
    author = "Argus Detection Platform"
    description = "Detects CVE-2026-48752: Incus arbitrary file read/write via malicious image template symlink"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479"
    cve = "CVE-2026-48752"
  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and $e.principal.process.file.full_path = /(?i)incusd?$/
    )
    or
    (
      $e.metadata.event_type = "FILE_OPEN"
      and $e.principal.process.file.full_path = /(?i)incusd?$/
      and (
        $e.target.file.full_path = /(?i)(templates\/|templates\\)/
        or $e.target.file.full_path = /(\/etc\/|\/root\/|\/proc\/|\/sys\/)/
      )
    )
    or
    (
      $e.metadata.event_type = "FILE_CREATION"
      and $e.principal.process.file.full_path = /(?i)incusd?$/
      and $e.target.file.full_path = /(\/etc\/|\/root\/|\/var\/snap\/incus\/|\.\.\/)/
    )
  condition:
    $e
}

event_simpleName IN ("ProcessRollup2", "SyntheticProcessRollup2", "FileOpenInfo", "FileWriteInfo")
| ImageFileName = /(?i)incusd?$/
| (
    TargetFilePath = /(?i)templates[\//]/
    OR TargetFilePath = /\.\.[\/\\]/
    OR TargetFilePath = /^\/etc\//
    OR TargetFilePath = /^\/root\//
    OR TargetFilePath = /^\/proc\//
    OR TargetFilePath = /^\/sys\//
    OR CommandLine = /(?i)(image import|container.*create|incus.*image)/
  )
| groupBy([ComputerName, UserName, ImageFileName, TargetFilePath, CommandLine], function=count(aid, as=EventCount))
| sort(EventCount, order=desc, limit=200)
| rename(ComputerName, as="Host")
| rename(UserName, as="User")
| rename(ImageFileName, as="Process")
| rename(TargetFilePath, as="TargetPath")
| rename(CommandLine, as="CmdLine")
| eval AlertName="CVE-2026-48752 Incus Template Symlink Escape", Severity="Critical"