CVE-2026-52806: Gogs RCE via git rebase --exec Argument Injection in PR Merge

union DeviceProcessEvents, SecurityEvent
| where TimeGenerated > ago(24h)
| where (InitiatingProcessCommandLine has "git" and ProcessCommandLine has "rebase" and ProcessCommandLine has "--exec")
   or (ProcessCommandLine has "git" and ProcessCommandLine has "rebase" and ProcessCommandLine has "--exec")
   or (ParentProcessName has_any ("gogs", "gogs.exe") and ProcessCommandLine has_any ("bash", "sh", "cmd", "powershell", "python", "perl", "curl", "wget", "nc", "ncat"))
| extend SuspiciousExec = case(
    ProcessCommandLine has "--exec" and ProcessCommandLine matches regex @"--exec[= ]['\"]?[^'\"]+[;&|`$]", "ArgumentInjection",
    ParentProcessName has_any ("gogs", "gogs.exe") and ProcessCommandLine has_any ("curl", "wget", "nc"), "SuspiciousChildProcess",
    "Other"
  )
| where SuspiciousExec != "Other"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, ParentProcessName, SuspiciousExec

index=os OR index=endpoint sourcetype IN ("linux_secure", "WinEventLog:Security", "xmlwineventlog", "crowdstrike:events:sensor")
| eval cmd=coalesce(CommandLine, process, command)
| eval parent=coalesce(ParentProcessName, parent_process_name, ppid_name)
| where (match(cmd, "git\s+rebase") AND match(cmd, "--exec"))
   OR (match(lower(parent), "gogs") AND match(cmd, "(curl|wget|bash|sh|nc|ncat|python|perl|powershell|cmd\.exe)"))
| eval injection_indicator=if(match(cmd, "--exec[= ]['\"]?[^'\"]*[;&|`\$]"), "argument_injection", "suspicious_child")
| eval risk_score=case(
    injection_indicator=="argument_injection", 95,
    injection_indicator=="suspicious_child", 75,
    true(), 50
  )
| table _time, host, user, parent, cmd, injection_indicator, risk_score
| sort -risk_score

sequence by host.name with maxspan=30s
  [process where event.type == "start"
   and (
     (process.name == "git" and process.args : "rebase" and process.args : "--exec")
     or
     (process.parent.name : ("gogs", "gogs.exe") and process.name : ("bash", "sh", "curl", "wget", "nc", "ncat", "python*", "perl"))
   )
  ]
  [process where event.type == "start"
   and process.parent.name : ("git", "gogs", "gogs.exe")
   and process.name : ("bash", "sh", "curl", "wget", "nc", "python*", "perl", "cmd.exe", "powershell.exe")
  ]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
       sourceip,
       username,
       "Command" AS command_line,
       "Parent Process" AS parent_process,
       QIDNAME(qid) AS event_name,
       magnitude
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Microsoft Windows Security Event Log', 'CrowdStrike Falcon')
  AND (
    ("Command" ILIKE '%git%rebase%--exec%')
    OR
    ("Parent Process" ILIKE '%gogs%' AND "Command" ILIKE ANY ('%curl%', '%wget%', '%bash%', '%sh %', '%nc %', '%python%', '%perl%', '%ncat%'))
  )
  AND LOGSOURCENAME(logsourceid) IS NOT NULL
LAST 24 HOURS

_sourceCategory=endpoint OR _sourceCategory=os/linux OR _sourceCategory=os/windows
| where (_raw matches /git\s+rebase.*--exec/ or (_raw matches /gogs/ and _raw matches /(curl|wget|bash|\bsh\b|nc |ncat|python|perl|cmd\.exe|powershell)/i))
| parse regex field=_raw "(?<command_line>git rebase[^\n]+)" nodrop
| parse regex field=_raw "(?<parent_proc>gogs[^\s]*)" nodrop
| eval risk = if(command_line matches /--exec[= ]['"]?[^'"]*[;&|`$]/, "HIGH", "MEDIUM")
| count by _sourceHost, _sourceCategory, command_line, parent_proc, risk
| sort by risk, _count desc

rule cve_2026_52806_gogs_rebase_exec_injection {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects CVE-2026-52806 git rebase --exec argument injection via Gogs pull request merge"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9"

  events:
    (
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      and $e1.target.process.command_line = /git\s+rebase.*--exec/
    )
    or
    (
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      and $e1.principal.process.file.full_path = /gogs/
      and (
        $e1.target.process.file.full_path = /\/(bash|sh|curl|wget|nc|ncat|python[0-9.]*|perl)$/
        or $e1.target.process.file.full_path = /\\(cmd\.exe|powershell\.exe)$/
      )
    )

  condition:
    $e1
}

#event_simpleName = ProcessRollup2
| where ImageFileName matches regex ".*git(\.exe)?$"
  and CommandLine matches regex "rebase.*--exec"
  OR (
    ParentBaseFileName in ("gogs", "gogs.exe")
    and ImageFileName matches regex ".*(bash|sh|curl|wget|nc|ncat|python[0-9.]*|perl|cmd\.exe|powershell\.exe)$"
  )
| eval InjectionType = case(
    CommandLine matches regex "--exec[= ]['"]?[^'"]*[;&|`$]", "ArgumentInjection",
    ParentBaseFileName in ("gogs", "gogs.exe"), "SuspiciousChildFromGogs",
    "Unknown"
  )
| table timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, InjectionType
| sort timestamp desc