CVE-2026-48769 — Incus Arbitrary File Write via Trusted Image Hash

let IncusImagePull = DeviceProcessEvents
| where FileName in~ ("incus", "incusd")
| where ProcessCommandLine has_any ("image copy", "launch", "image pull", "image import")
| project TimeGenerated, DeviceId, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath;
let SuspiciousWrites = DeviceFileEvents
| where InitiatingProcessFileName in~ ("incus", "incusd")
| where FolderPath has_any ("/etc/", "/usr/bin/", "/usr/sbin/", "/bin/", "/sbin/", "/lib/", "/lib64/", "/root/", "/home/")
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| project TimeGenerated, DeviceId, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine, InitiatingProcessAccountName;
IncusImagePull
| join kind=inner SuspiciousWrites on DeviceId
| where SuspiciousWrites.TimeGenerated between (IncusImagePull.TimeGenerated .. (IncusImagePull.TimeGenerated + 5m))
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, WrittenFile=SuspiciousWrites.FolderPath, InitiatingProcessCommandLine

index=endpoint sourcetype IN ("xmlwineventlog", "linux_secure", "sysmon", "auditd")
| eval proc=lower(coalesce(process_name, process))
| where proc IN ("incus", "incusd")
| eval cmd=coalesce(process, CommandLine, command)
| where match(cmd, "(image\s+copy|image\s+pull|image\s+import|launch)")
| eval evt_time=_time
| join type=inner DeviceId
    [search index=endpoint sourcetype IN ("sysmon", "auditd", "linux_secure")
     | eval proc=lower(coalesce(process_name, process))
     | where proc IN ("incus", "incusd")
     | eval filepath=coalesce(TargetFilename, file_path, object)
     | where match(filepath, "^(/etc/|/usr/bin/|/usr/sbin/|/bin/|/sbin/|/lib/|/root/|/home/)")
     | where EventCode IN ("11", "2") OR type IN ("write", "create")
     | eval write_time=_time
     | where (write_time - evt_time) >= 0 AND (write_time - evt_time) <= 300
     | table DeviceId, filepath, write_time]
| table _time, host, user, cmd, filepath, write_time
| sort -_time

sequence by host.id with maxspan=5m
  [process where event.type == "start"
   and process.name in ("incus", "incusd")
   and process.args : ("image copy", "image pull", "image import", "launch")]
  [file where event.type in ("creation", "change")
   and process.name in ("incus", "incusd")
   and (
     file.path like "/etc/*" or
     file.path like "/usr/bin/*" or
     file.path like "/usr/sbin/*" or
     file.path like "/bin/*" or
     file.path like "/sbin/*" or
     file.path like "/lib/*" or
     file.path like "/root/*" or
     file.path like "/home/*"
   )
  ]

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
       sourceip, username, "Process Name", "Command", "File Path"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Microsoft Windows Security Event Log', 'Syslog')
  AND ("Process Name" ILIKE '%incus%' OR "Process Name" ILIKE '%incusd%')
  AND (
    "Command" ILIKE '%image copy%'
    OR "Command" ILIKE '%image pull%'
    OR "Command" ILIKE '%image import%'
    OR "Command" ILIKE '%launch%'
  )
  AND "File Path" MATCHES '(?i)^(/etc/|/usr/bin/|/usr/sbin/|/bin/|/sbin/|/lib/|/root/|/home/).*'
LAST 24 HOURS
ORDER BY devicetime DESC

_sourceCategory=endpoint/linux OR _sourceCategory=endpoint/sysmon
| where process_name matches /incus(d)?/
| where command matches /image (copy|pull|import)|launch/
| timeslice 5m
| join
  (
    _sourceCategory=endpoint/linux OR _sourceCategory=endpoint/sysmon
    | where process_name matches /incus(d)?/
    | where file_path matches /^\/etc\/|\/usr\/bin\/|\/usr\/sbin\/|\/bin\/|\/sbin\/|\/lib\/|\/root\/|\/home\//
    | where event_type in ("file_create", "file_modify", "file_write")
  ) on host
| fields _time, host, user, command, file_path
| sort by _time desc

rule cve_2026_48769_incus_arbitrary_file_write {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-48769 exploitation — Incus arbitrary file write via trusted image hash"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /\/(usr\/bin\/|bin\/|usr\/local\/bin\/)incus(d)?$/
    (
      $proc.target.process.command_line = /image\s+(copy|pull|import)/ or
      $proc.target.process.command_line = /^incus\s+launch/
    )
    $proc.principal.hostname = $host

    $file.metadata.event_type = "FILE_CREATION"
    $file.principal.process.file.full_path = /incus(d)?$/
    (
      $file.target.file.full_path = /^\/etc\// or
      $file.target.file.full_path = /^\/usr\/(bin|sbin)\// or
      $file.target.file.full_path = /^\/(bin|sbin)\// or
      $file.target.file.full_path = /^\/root\// or
      $file.target.file.full_path = /^\/home\//
    )
    $file.principal.hostname = $host

    $proc.metadata.event_timestamp.seconds <= $file.metadata.event_timestamp.seconds
    $file.metadata.event_timestamp.seconds <= $proc.metadata.event_timestamp.seconds + 300

  condition:
    $proc and $file
}

event_simpleName IN (ProcessRollup2, SyntheticProcessRollup2)
| ImageFileName = /\/(incus|incusd)$/
| CommandLine = /(image\s+(copy|pull|import)|^incus\s+launch)/
| join
  (
    event_simpleName IN ("FileWritten", "PeFileWritten", "NewExecutableWritten")
    | TargetFileName = /^(\/etc\/|\/usr\/bin\/|\/usr\/sbin\/|\/bin\/|\/sbin\/|\/lib\/|\/root\/|\/home\/)/
    | ImageFileName = /\/(incus|incusd)$/
  ) by aid
| eval timedelta = abs(timestamp - join_timestamp)
| where timedelta <= 300000
| table timestamp, ComputerName, UserName, CommandLine, TargetFileName, timedelta
| sort -timestamp