CoreWCF SAML Token Signature Validation Authentication Bypass (CVE-2026-54782)

union DeviceNetworkEvents, DeviceProcessEvents, AuditLogs
| where TimeGenerated > ago(24h)
| where (
    (ActionType == "ConnectionSuccess" and RemotePort in (80, 443, 808, 9000))
    or (OperationName has "WCF" and ResultDescription has_any ("SAML", "token", "assertion"))
    or (ProcessCommandLine has_any ("CoreWCF", "System.ServiceModel"))
)
| extend SamlIndicator = iff(
    OperationName has "SAML" or InitiatedBy has "SAML" or AdditionalDetails has "assertion",
    true, false
)
| where SamlIndicator == true
    or (ActionType == "ConnectionSuccess" and isnotempty(RemoteUrl) and RemoteUrl matches regex @"(?i)(saml|wstrust|sts|adfs)")
| extend RiskScore = case(
    SamlIndicator == true and ResultDescription has "bypass", 100,
    SamlIndicator == true and ResultDescription has_any ("unauthenticated", "anonymous"), 90,
    SamlIndicator == true, 70,
    50
)
| project TimeGenerated, DeviceName, AccountName, ActionType, OperationName, ResultDescription, RemoteUrl, RiskScore, AdditionalDetails
| sort by RiskScore desc, TimeGenerated desc

index=* sourcetype IN ("WinEventLog:Application", "iis", "wineventlog", "dotnet:applog", "xmlsyslog")
| where match(_raw, "(?i)(CoreWCF|System\.ServiceModel|SAML|WSTrust|STS|assertion|token)")
| eval saml_bypass_indicator=if(
    match(_raw, "(?i)(signature.*invalid|unsigned.*assertion|token.*bypass|auth.*skip|SAML.*fail|SecurityTokenValidationException)"),
    1, 0
)
| eval exploit_indicator=if(
    match(_raw, "(?i)(anonymous.*access|unauthenticated.*call|bypass.*auth|forged.*token)"),
    1, 0
)
| eval risk_score=case(
    saml_bypass_indicator=1 AND exploit_indicator=1, 100,
    saml_bypass_indicator=1, 75,
    exploit_indicator=1, 60,
    true(), 30
)
| where risk_score >= 60
| stats count AS event_count, max(risk_score) AS max_risk, values(host) AS affected_hosts, values(source) AS log_sources, earliest(_time) AS first_seen, latest(_time) AS last_seen BY src_ip, user
| sort - max_risk
| table src_ip, user, event_count, max_risk, affected_hosts, log_sources, first_seen, last_seen

sequence by host.name, user.name with maxspan=5m
  [network where network.protocol in ("http", "https") and
   destination.port in (80, 443, 808, 8080, 9000) and
   url.path like~ "*saml*" or url.path like~ "*wstrust*" or url.path like~ "*sts*"]
  [process where process.name in ("w3wp.exe", "dotnet.exe") and
   process.args like~ "*CoreWCF*" or process.args like~ "*System.ServiceModel*"]
  [any where event.dataset == "windows.application" and
   message like~ "*SAML*" and
   (message like~ "*bypass*" or message like~ "*invalid signature*" or message like~ "*unsigned*")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source,
  "URL" AS request_url,
  magnitude,
  UTF8(payload) AS raw_event
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Microsoft Windows Security Event Log', 'Microsoft .NET')
  AND (
    LOWER(UTF8(payload)) LIKE '%corewcf%'
    OR LOWER(UTF8(payload)) LIKE '%saml%'
    OR LOWER(UTF8(payload)) LIKE '%wstrust%'
    OR LOWER(UTF8(payload)) LIKE '%assertion%'
  )
  AND (
    LOWER(UTF8(payload)) LIKE '%signature%invalid%'
    OR LOWER(UTF8(payload)) LIKE '%bypass%auth%'
    OR LOWER(UTF8(payload)) LIKE '%unsigned%token%'
    OR LOWER(UTF8(payload)) LIKE '%securitytokenvalidation%'
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=*windows* OR _sourceCategory=*iis* OR _sourceCategory=*dotnet*
| where _raw matches /(?i)(CoreWCF|System\.ServiceModel|SAML|WSTrust|assertion)/
| parse regex field=_raw "(?i)(?<event_type>signature.*?invalid|unsigned.*?assertion|bypass.*?auth|SecurityTokenValidationException|anonymous.*?access)" nodrop
| where !isEmpty(event_type)
| parse regex field=_raw "(?i)(?:src[= ]+|source[= ]+|client[= ]+)(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| parse regex field=_raw "(?i)(?:user[= ]+|username[= ]+)(?<username>[\w@\.\-]+)" nodrop
| timeslice 5m
| count by _timeslice, src_ip, username, event_type
| sort by _count desc

rule cve_2026_54782_corewcf_saml_bypass {
  meta:
    author = "df00tech"
    description = "Detects CVE-2026-54782 CoreWCF SAML authentication bypass attempts"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-xjr9-gg9q-jx3v"

  events:
    (
      $e1.metadata.event_type = "NETWORK_HTTP"
      and (
        re.regex($e1.network.http.request_url, `(?i)(saml|wstrust|sts|assertion)`) or
        re.regex($e1.target.url, `(?i)(saml|wstrust|sts)`)
      )
      and $e1.target.port in (80, 443, 808, 8080, 9000)
    )
    or
    (
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      and (
        re.regex($e1.target.process.command_line, `(?i)(CoreWCF|System\.ServiceModel)`) or
        $e1.target.process.file.full_path = /w3wp\.exe/ or
        $e1.target.process.file.full_path = /dotnet\.exe/
      )
    )
    or
    (
      $e1.metadata.event_type = "GENERIC_EVENT"
      and re.regex($e1.metadata.description, `(?i)(SAML|CoreWCF|assertion|WSTrust)`)
      and re.regex($e1.metadata.description, `(?i)(bypass|invalid signature|unsigned|unauthenticated|SecurityTokenValidation)`)
    )

  condition:
    $e1
}

#event_simpleName IN ("NetworkConnectIP4", "ProcessRollup2", "DnsRequest")
| $falcon.event.Severity = "High" OR $falcon.event.Severity = "Critical"
| event_platform = "Win"
| (
  (
    event_simpleName = "NetworkConnectIP4"
    AND (RemotePort IN (80, 443, 808, 8080, 9000))
    AND (DomainName = /(?i)(saml|wstrust|sts|adfs|shibboleth)/ OR RemoteAddressIP4 != null)
  )
  OR
  (
    event_simpleName = "ProcessRollup2"
    AND (
      ImageFileName = /(?i)(w3wp\.exe|dotnet\.exe|iisexpress\.exe)/
      OR CommandLine = /(?i)(CoreWCF|System\.ServiceModel|SAML)/
    )
  )
  OR
  (
    event_simpleName = "DnsRequest"
    AND DomainName = /(?i)(saml|sts|adfs|wstrust)/
  )
)
| groupby([aid, ComputerName, UserName, ImageFileName, RemotePort, DomainName], function=[count(aid, as=event_count), min(timestamp, as=first_seen), max(timestamp, as=last_seen)])
| where event_count > 1
| sort(event_count, order=desc)