CVE-2026-48755: Incus Argument Injection in Backup Compression Algorithm (AFW/ACE)

union
(
    DeviceProcessEvents
    | where FileName in~ ("gzip", "bzip2", "xz", "zstd", "lz4", "tar")
    | where InitiatingProcessFileName =~ "incusd" or InitiatingProcessParentFileName =~ "incusd"
    | where ProcessCommandLine matches regex @"[;&|`$()\\\\]" or ProcessCommandLine contains "--" or ProcessCommandLine contains "../"
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessFileName, FolderPath
    | extend Technique = "Argument Injection via Incus Backup Compression"
),
(
    Syslog
    | where ProcessName =~ "incusd" or SyslogMessage contains "incusd"
    | where SyslogMessage contains "backup" and SyslogMessage contains "compress"
    | where SyslogMessage matches regex @"[;&|`$()\\\\]" or SyslogMessage contains "--output" or SyslogMessage contains "--use-compress-program"
    | project TimeGenerated, HostName = Computer, ProcessName, SyslogMessage
    | extend Technique = "Argument Injection via Incus Backup Compression"
)
| where isnotempty(TimeGenerated)
| order by TimeGenerated desc

index=linux (sourcetype=syslog OR sourcetype=auditd OR sourcetype=osquery_results)
| where (process="incusd" OR parent_process="incusd" OR process_name="incusd")
  OR (message LIKE "%incusd%" AND message LIKE "%compress%")
| eval suspicious_args=if(
    match(cmdline, "[;&|`$()\\\\]") OR
    match(cmdline, "--use-compress-program") OR
    match(cmdline, "\.\.[\\/]") OR
    match(cmdline, "--checkpoint-action") OR
    match(cmdline, "-I\s"),
    1, 0)
| where (process IN ("gzip", "bzip2", "xz", "zstd", "lz4", "tar", "pigz") AND parent_process="incusd")
  OR suspicious_args=1
| table _time, host, user, process, parent_process, cmdline, message
| eval Technique="CVE-2026-48755 Incus Argument Injection"
| sort -_time

sequence by host.name with maxspan=30s
  [process where process.name == "incusd" and event.type == "start"]
  [process where process.parent.name == "incusd"
    and process.name in ("gzip", "bzip2", "xz", "zstd", "lz4", "tar", "pigz")
    and (
      process.args : ["*;&*", "*|*", "*`*", "*$()*", "*--use-compress-program*", "*--checkpoint-action*", "*-I *", "*../*"]
      or process.command_line : ("*; *", "* | *", "*`*", "*$(*")
    )
  ]

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  sourceip,
  "processname",
  "parentprocessname",
  "processcmdline",
  QIDNAME(qid) AS event_name
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Linux Syslog', 'Auditd')
  AND (
    ("parentprocessname" ILIKE '%incusd%')
    AND "processname" IN ('gzip', 'bzip2', 'xz', 'zstd', 'lz4', 'tar', 'pigz')
    AND (
      "processcmdline" MATCHES '.*[;&|`$()\\\\].*'
      OR "processcmdline" ILIKE '%--use-compress-program%'
      OR "processcmdline" ILIKE '%--checkpoint-action%'
      OR "processcmdline" ILIKE '%../%'
    )
  )
  AND LAST 24 HOURS
ORDER BY devicetime DESC

_sourceCategory=linux/syslog OR _sourceCategory=linux/audit
| where %"process.name" in ("gzip", "bzip2", "xz", "zstd", "lz4", "tar", "pigz")
  and (%"process.parent.name" matches /incusd/ or _raw matches /incusd/)
| where _raw matches /[;&|`$()\\]/ 
  or _raw matches /--use-compress-program/
  or _raw matches /--checkpoint-action/
  or _raw matches /\.\.\/|\.\.\\/
  or _raw matches /-I\s+/
| parse regex field=_raw "(?<cmdline>incusd.{0,500})" nodrop
| count by _sourceHost, %"process.name", cmdline
| sort by _count desc

rule cve_2026_48755_incus_argument_injection {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects CVE-2026-48755: Incus argument injection in backup compression leading to AFW/ACE"
    severity = "CRITICAL"
    priority = "HIGH"
    mitre_attack_tactic = "TA0001, TA0004, TA0002"
    mitre_attack_technique = "T1190, T1611, T1059"
    reference = "https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4"

  events:
    $e1.metadata.event_type = "PROCESS_LAUNCH"
    $e1.principal.process.file.full_path = /incusd$/
    $e2.metadata.event_type = "PROCESS_LAUNCH"
    $e2.principal.process.parent_process.file.full_path = /incusd$/
    $e2.target.process.file.full_path = /(gzip|bzip2|xz|zstd|lz4|tar|pigz)$/
    (
      re.regex($e2.target.process.command_line, `[;&|\`$()\\\\]`) or
      re.contains($e2.target.process.command_line, "--use-compress-program") or
      re.contains($e2.target.process.command_line, "--checkpoint-action") or
      re.contains($e2.target.process.command_line, "-I ") or
      re.regex($e2.target.process.command_line, `\.\.[/\\\\]`)
    )
    $e1.metadata.collected_timestamp.seconds <= $e2.metadata.collected_timestamp.seconds
    $e2.metadata.collected_timestamp.seconds - $e1.metadata.collected_timestamp.seconds <= 60

  match:
    $e1.principal.hostname over 1m

  outcome:
    $risk_score = 95
    $hostname = $e1.principal.hostname
    $compression_tool = $e2.target.process.file.full_path
    $injected_cmdline = $e2.target.process.command_line

  condition:
    $e1 and $e2
}

#event_simpleName=ProcessRollup2
| ImageFileName = /(\/|\\)(gzip|bzip2|xz|zstd|lz4|tar|pigz)$/i
| ParentBaseFileName = "incusd"
| CommandLine = /[;&|`$()\\]|--use-compress-program|--checkpoint-action|\.\.[/\\]|-I\s/
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, ParentCommandLine])
| sort(@timestamp, order=desc, limit=200)