Nuclio Cron Trigger Header/Body Command Injection (CVE-2026-52831)

KubePodInventory
| where Namespace has "nuclio"
| where ContainerName has "processor" or ContainerName has "nuclio"
| join kind=inner (
    ContainerLog
    | where LogEntry matches regex @"(;|\||&&|\$\(|`|>|<|\bcurl\b|\bwget\b|\bnc\b|/bin/sh|/bin/bash)"
) on ContainerID
| project TimeGenerated, Namespace, PodName=Name, ContainerName, LogEntry
| order by TimeGenerated desc

index=kubernetes sourcetype="kube:container:log" (namespace="nuclio" OR container_name="*nuclio*" OR container_name="*processor*")
| regex log="(;|\||&&|\$\(|`|>|<|\bcurl\b|\bwget\b|\bnc\b|/bin/sh|/bin/bash)"
| eval injection_indicator=1
| table _time, namespace, pod_name, container_name, log
| sort -_time

process where event.type == "start" and
  process.parent.name in ("nuclio-handler", "processor", "handler") and
  (process.name in ("sh", "bash", "dash") or
   process.args : ("curl*", "wget*", "nc*", "*|*", "*;*", "*&&*", "*$(*"))

SELECT DATEFORMAT(devicetime,'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, "Container Name", "Namespace", payload
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Kubernetes%'
AND ("Namespace" ILIKE '%nuclio%' OR "Container Name" ILIKE '%processor%')
AND (payload ILIKE '%curl %' OR payload ILIKE '%wget %' OR payload ILIKE '%/bin/sh%' OR payload ILIKE '%/bin/bash%' OR payload ILIKE '%&&%' OR payload ILIKE '%$(%' OR payload ILIKE '%|%')
LAST 24 HOURS

_sourceCategory=kubernetes/container/logs (namespace="nuclio" OR container_name="*nuclio*" OR container_name="*processor*")
| parse regex "(?<log_line>.*)"
| where log_line matches "*curl *" or log_line matches "*wget *" or log_line matches "*/bin/sh*" or log_line matches "*/bin/bash*" or log_line matches "*&&*" or log_line matches "*$(*" or log_line matches "*|*"
| count by container_name, namespace
| sort by _count

rule nuclio_cron_trigger_command_injection {
  meta:
    author = "detection-engineering"
    description = "Detects potential exploitation of CVE-2026-52831 Nuclio cron trigger command injection"
    severity = "CRITICAL"
    cve = "CVE-2026-52831"
  events:
    $process.metadata.event_type = "PROCESS_LAUNCH"
    $process.target.process.command_line = /(curl|wget|nc|\/bin\/sh|\/bin\/bash|&&|\$\(|`)/ nocase
    $process.principal.process.file.full_path = /(nuclio-handler|processor)/ nocase
  condition:
    $process
}

#event_simpleName=ProcessRollup2
| in(field="ParentBaseFileName", values=["processor", "nuclio-handler", "handler"], ignoreCase=true)
| regex(field="CommandLine", pattern="(curl|wget|nc |/bin/sh|/bin/bash|&&|\\$\\(|`|\\|)", ignoreCase=true)
| table(["@timestamp", "ComputerName", "ParentBaseFileName", "FileName", "CommandLine"])
| sort("@timestamp", order=desc)