LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability

let timeframe = 1h;
let litespeed_paths = dynamic(['/usr/local/lsws', '/opt/cpanel/ea-php', '/etc/lsws', '/var/lsws']);
let sensitive_targets = dynamic(['/etc/passwd', '/etc/shadow', '/root/', '/home/', '/etc/ssh/', '/etc/sudoers']);
union
(
    DeviceFileEvents
    | where TimeGenerated >= ago(timeframe)
    | where ActionType in ('FileCreated', 'FileModified')
    | where FolderPath has_any (litespeed_paths)
    | where FileType == 'SymbolicLink'
    | extend TargetPath = tostring(parse_json(AdditionalFields).SymlinkTarget)
    | where TargetPath has_any (sensitive_targets)
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, FolderPath, FileName, TargetPath, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType
),
(
    DeviceProcessEvents
    | where TimeGenerated >= ago(timeframe)
    | where ProcessCommandLine matches regex @'ln\s+-s'
    | where InitiatingProcessFileName in~ ('lsup.sh', 'lsphp', 'litespeed', 'lshttpd', 'cpanel-plugin')
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
)
| extend AlertSeverity = 'High'
| extend Recommendation = 'Update LiteSpeed cPanel Plugin immediately. Investigate symlink targets for unauthorized file access.'
| order by TimeGenerated desc

index=os OR index=endpoint sourcetype IN ("linux_audit", "auditd", "sysmon_for_linux", "osquery")
| eval event_time=_time
| search (syscall="symlink" OR syscall="symlinkat" OR process_name IN ("ln") AND ("ln -s" OR "ln --symbolic"))
| eval cmd=coalesce(cmd, command, cmdline)
| eval uid=coalesce(uid, user, auid)
| eval path_val=coalesce(nametype, path, file_path)
| where match(cmd, "(?i)(ln\s+-s|symlink)")
| eval suspicious_target=if(match(cmd, "(?i)(/etc/passwd|/etc/shadow|/root/|/etc/ssh|/etc/sudoers|/etc/cron|/proc/)"), 1, 0)
| eval litespeed_context=if(match(cmd, "(?i)(lsws|lsphp|lshttpd|litespeed|cpanel.plugin)") OR match(path_val, "(?i)(/usr/local/lsws|/opt/cpanel|/var/lsws|/etc/lsws)"), 1, 0)
| where suspicious_target=1 OR litespeed_context=1
| eval risk_score=case(suspicious_target=1 AND litespeed_context=1, 90, suspicious_target=1, 70, litespeed_context=1, 50, true(), 30)
| table _time, host, user, uid, cmd, path_val, suspicious_target, litespeed_context, risk_score
| sort -risk_score, -_time

sequence by host.name, user.name with maxspan=5m
  [file where event.action in ("creation", "change") and
   file.type == "symlink" and
   (
     file.path like~ "/usr/local/lsws/*" or
     file.path like~ "/opt/cpanel/*" or
     file.path like~ "/var/lsws/*" or
     file.path like~ "/etc/lsws/*"
   )]
  [file where event.action in ("creation", "change", "access") and
   (
     file.path like~ "/etc/passwd" or
     file.path like~ "/etc/shadow" or
     file.path like~ "/root/*" or
     file.path like~ "/etc/ssh/*" or
     file.path like~ "/etc/sudoers*"
   )]

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "HOST"(sourceip) AS hostname,
  QIDNAME(qid) AS event_name,
  "UTF8"(payload) AS raw_payload,
  CATEGORYNAME(category) AS category
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Syslog', 'IBM Security QRadar Log Source Extension')
  AND (
    ("UTF8"(payload) ILIKE '%symlink%' OR "UTF8"(payload) ILIKE '%ln -s%' OR "UTF8"(payload) ILIKE '%symlinkat%')
    AND (
      "UTF8"(payload) ILIKE '%lsws%'
      OR "UTF8"(payload) ILIKE '%lsphp%'
      OR "UTF8"(payload) ILIKE '%litespeed%'
      OR "UTF8"(payload) ILIKE '%cpanel-plugin%'
      OR "UTF8"(payload) ILIKE '%/usr/local/lsws%'
    )
  )
  OR (
    ("UTF8"(payload) ILIKE '%ln -s%' OR "UTF8"(payload) ILIKE '%symlinkat%')
    AND (
      "UTF8"(payload) ILIKE '%/etc/shadow%'
      OR "UTF8"(payload) ILIKE '%/etc/passwd%'
      OR "UTF8"(payload) ILIKE '%/etc/sudoers%'
      OR "UTF8"(payload) ILIKE '%/root/%'
      OR "UTF8"(payload) ILIKE '%/etc/ssh/%'
    )
  )
LAST 60 MINUTES
ORDER BY devicetime DESC

_sourceCategory=linux/audit OR _sourceCategory=linux/syslog OR _sourceCategory=endpoint/linux
| parse regex "(?<raw_cmd>(?:ln\s+-s|symlink|symlinkat)[^\n]*)"
| where !isNull(raw_cmd)
| if (raw_cmd matches /(?i)(lsws|lsphp|litespeed|cpanel.plugin|\/usr\/local\/lsws|\/var\/lsws|\/etc\/lsws)/, 1, 0) as litespeed_context
| if (raw_cmd matches /(?i)(\/etc\/passwd|\/etc\/shadow|\/root\/|\/etc\/ssh|\/etc\/sudoers|\/proc\/)/, 1, 0) as sensitive_target
| where litespeed_context = 1 OR sensitive_target = 1
| fields _messageTime, _sourceHost, _sourceCategory, raw_cmd, litespeed_context, sensitive_target
| sort by _messageTime desc
| count by _sourceHost, litespeed_context, sensitive_target
| sort by _count desc

rule litespeed_cpanel_symlink_following_cve_2026_54420 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-54420 LiteSpeed cPanel Plugin symlink following exploitation"
    severity = "HIGH"
    priority = "HIGH"
    cve = "CVE-2026-54420"
    mitre_attack = "T1574, T1548, T1083"
    yara_version = "YL2.0"
    rule_version = "1.0"
    false_positives = "LiteSpeed upgrades, cPanel maintenance scripts"

  events:
    (
      $e.metadata.event_type = "FILE_CREATION" or
      $e.metadata.event_type = "FILE_MODIFICATION"
    )
    and (
      re.regex($e.target.file.full_path, `(?i)/usr/local/lsws|/var/lsws|/etc/lsws|/opt/cpanel`) or
      re.regex($e.principal.process.file.full_path, `(?i)lsphp|lshttpd|litespeed|lsup\.sh`)
    )
    and $e.target.file.symlink = true
    and re.regex($e.target.file.symlink_target_path, `(?i)/etc/passwd|/etc/shadow|/root|/etc/ssh|/etc/sudoers|/proc/`)
    
  condition:
    $e
}

#event_simpleName IN ("SyntheticProcessRollup2", "ProcessRollup2", "FileOpenInfo")
| ComputerName, UserName, FileName, CommandLine, FilePath
| CommandLine = /ln\s+(-s|--symbolic)/i
  OR (FileName IN ("lsphp", "lshttpd", "litespeed", "lsup.sh") AND CommandLine = /symlink/i)
| eval litespeed_context = if(CommandLine = /(\/usr\/local\/lsws|\/var\/lsws|\/etc\/lsws|\/opt\/cpanel)/i OR FilePath = /(\/usr\/local\/lsws|\/var\/lsws)/i, "yes", "no")
| eval sensitive_target = if(CommandLine = /(\/etc\/passwd|\/etc\/shadow|\/root\/|\/etc\/ssh|\/etc\/sudoers)/i, "yes", "no")
| where litespeed_context = "yes" OR sensitive_target = "yes"
| table timestamp, ComputerName, UserName, FileName, CommandLine, litespeed_context, sensitive_target
| sort timestamp desc