kobako Sandbox Escape to Host RCE (CVE-2026-55107)

let evalParents = dynamic(["ruby","rails","puma","unicorn","rackup","sidekiq","bundle","irb"]);
let suspiciousChildren = dynamic(["sh","bash","dash","zsh","nc","ncat","netcat","curl","wget","python","python3","perl","id","whoami","uname","cat","chmod","base64"]);
DeviceProcessEvents
| where InitiatingProcessFileName has_any (evalParents)
| where FileName in~ (suspiciousChildren)
| where not(ProcessCommandLine has_any ("assets:precompile","webpack","yarn","bundle install","spec"))
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessId, InitiatingProcessId
| order by Timestamp desc

index=* (sourcetype=linux:audit OR sourcetype=sysmon OR sourcetype=osquery:process)
| eval parent=lower(coalesce(parent_process_name, ParentImage, parent))
| eval child=lower(coalesce(process_name, Image, name))
| where match(parent, "ruby|rails|puma|unicorn|rackup|sidekiq|bundle|irb")
| where match(child, "(^|/)(sh|bash|dash|zsh|nc|ncat|netcat|curl|wget|python3?|perl|id|whoami|uname|chmod|base64)$")
| search NOT (CommandLine="*assets:precompile*" OR CommandLine="*webpack*" OR CommandLine="*bundle install*")
| table _time host user parent child CommandLine process_id parent_process_id
| sort - _time

process where event.type == "start" and
  process.parent.name in ("ruby","rails","puma","unicorn","rackup","sidekiq","bundle","irb") and
  process.name in ("sh","bash","dash","zsh","nc","ncat","netcat","curl","wget","python","python3","perl","id","whoami","uname","chmod","base64") and
  not process.command_line like~ ("*assets:precompile*","*webpack*","*bundle install*")

SELECT QIDNAME(qid) AS event, "parentProcessName", "processName", "Process CommandLine" AS cmd, sourceip, username, DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS time
FROM events
WHERE LOWER("parentProcessName") IMATCHES '.*(ruby|rails|puma|unicorn|rackup|sidekiq|bundle|irb).*'
AND LOWER("processName") IMATCHES '.*(sh|bash|dash|zsh|nc|ncat|netcat|curl|wget|python3?|perl|id|whoami|uname|chmod|base64)$'
AND "Process CommandLine" NOT ILIKE '%assets:precompile%'
AND "Process CommandLine" NOT ILIKE '%webpack%'
AND "Process CommandLine" NOT ILIKE '%bundle install%'
ORDER BY devicetime DESC LAST 24 HOURS

_sourceCategory=*linux* OR _sourceCategory=*sysmon*
| json auto nodrop
| lower(parent_process_name) as parent
| lower(process_name) as child
| where parent matches /(ruby|rails|puma|unicorn|rackup|sidekiq|bundle|irb)/
| where child matches /(^|\/)(sh|bash|dash|zsh|nc|ncat|netcat|curl|wget|python3?|perl|id|whoami|uname|chmod|base64)$/
| where !(commandline matches /assets:precompile|webpack|bundle install/)
| fields _messagetime, host, user, parent, child, commandline
| sort by _messagetime desc

rule kobako_cve_2026_55107_host_rce {
  meta:
    author = "argus"
    description = "Ruby/Rack (kobako) worker spawns shell or recon utility - CVE-2026-55107 sandbox escape"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)(ruby|rails|puma|unicorn|rackup|sidekiq|bundle|irb)`)
    re.regex($e.target.process.file.full_path, `(?i)/(sh|bash|dash|zsh|nc|ncat|netcat|curl|wget|python3?|perl|id|whoami|uname|chmod|base64)$`)
    not re.regex($e.target.process.command_line, `assets:precompile|webpack|bundle install`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(ruby|rails|puma|unicorn|rackup|sidekiq|bundle|irb)/i
| FileName=/^(sh|bash|dash|zsh|nc|ncat|netcat|curl|wget|python3?|perl|id|whoami|uname|chmod|base64)$/i
| CommandLine!=/assets:precompile|webpack|bundle install/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, RawProcessId])
| sort(@timestamp, order=desc)