Yamcs StreamSQL LIKE Pattern Janino Code Injection (CVE-2026-55565)

let yamcsProc = dynamic(["java", "java.exe"]);
let suspChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","bash","sh","dash","zsh","whoami","curl","wget","nc","ncat","python","python3","perl","ruby"]);
(
// Anomalous child process spawned by the Yamcs JVM (Janino-compiled injected code)
DeviceProcessEvents
| where InitiatingProcessCommandLine has "yamcs" or InitiatingProcessCommandLine has "org.yamcs"
| where InitiatingProcessFileName in~ (yamcsProc)
| where FileName in~ (suspChildren)
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, Detected="yamcs_jvm_child_process"
)
| union (
// StreamSQL LIKE clause carrying Java code artifacts over HTTP API
let httpEvents = union isfuzzy=true DeviceNetworkEvents;
DeviceNetworkEvents
| where RemoteUrl has_any ("streamql","streamsql","/api/archive")
| where RemoteUrl has "LIKE" and RemoteUrl has_any ("Runtime","getRuntime","exec(","ProcessBuilder","\"+","new java")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessCommandLine, Detected="streamsql_like_java_injection"
)

(index=* sourcetype="yamcs:httpd" OR sourcetype="yamcs:api" (uri_path="*streamql*" OR uri_path="*streamsql*" OR uri_path="*/api/archive*") ("LIKE" AND ("getRuntime" OR "Runtime." OR "exec(" OR "ProcessBuilder" OR "new java" OR "\"+")))
| eval detection="streamsql_like_java_injection"
| table _time, host, src_ip, user, uri_path, http_user_agent, detection
| append
[ search (index=* (sourcetype="linux:audit" OR sourcetype="Syslog" OR sourcetype="WinEventLog:Security" OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") (parent_process="*java*" OR parent_process_name="java" OR parent_process_name="java.exe") (process_name IN ("sh","bash","dash","zsh","cmd.exe","powershell.exe","pwsh.exe","whoami","curl","wget","nc","ncat","python","python3","perl","ruby")) (parent_process="*yamcs*" OR parent_process="*org.yamcs*"))
| eval detection="yamcs_jvm_child_process"
| table _time, host, user, parent_process, process_name, process, detection ]

sequence by host.name with maxspan=5m
  [ network where event.category == "network" and
      (url.path : "*streamql*" or url.path : "*streamsql*" or url.path : "*/api/archive*") and
      (url.query : "*LIKE*" and (url.query : "*getRuntime*" or url.query : "*ProcessBuilder*" or url.query : "*exec(*")) ]
  [ process where event.type == "start" and
      process.parent.name : ("java", "java.exe") and
      process.parent.command_line : ("*yamcs*", "*org.yamcs*") and
      process.name : ("sh","bash","dash","zsh","cmd.exe","powershell.exe","pwsh.exe","whoami","curl","wget","nc","ncat","python","python3") ]

SELECT QIDNAME(qid) AS event, sourceip, destinationip, username, "URL" AS url, "Process Name" AS process, "Parent Process Name" AS parent_process, starttime FROM events WHERE (("URL" ILIKE '%streamql%' OR "URL" ILIKE '%streamsql%' OR "URL" ILIKE '%/api/archive%') AND "URL" ILIKE '%LIKE%' AND ("URL" ILIKE '%getRuntime%' OR "URL" ILIKE '%ProcessBuilder%' OR "URL" ILIKE '%exec(%')) OR ("Parent Process Name" ILIKE '%java%' AND "Parent Process Name" ILIKE '%yamcs%' AND ("Process Name" ILIKE '%sh' OR "Process Name" ILIKE '%bash%' OR "Process Name" ILIKE '%cmd.exe%' OR "Process Name" ILIKE '%powershell%' OR "Process Name" ILIKE '%whoami%' OR "Process Name" ILIKE '%curl%' OR "Process Name" ILIKE '%wget%' OR "Process Name" ILIKE '%nc%')) LAST 24 HOURS

(_sourceCategory=*yamcs* OR _sourceCategory=*http* OR _sourceCategory=*endpoint*)
| where (url matches "*streamql*" or url matches "*streamsql*" or url matches "*/api/archive*")
| where url matches "*LIKE*" and (url matches "*getRuntime*" or url matches "*ProcessBuilder*" or url matches "*exec(*" or url matches "*new java*")
| count by _sourceHost, src_ip, user, url
| sort by _count desc

rule yamcs_streamsql_janino_rce_cve_2026_55565 {
  meta:
    author = "Argus Detection Platform"
    description = "Yamcs StreamSQL LIKE pattern Janino code injection (CVE-2026-55565)"
    severity = "CRITICAL"
    cve = "CVE-2026-55565"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($e.network.http.referral_url, `(?i)stream(ql|sql)|/api/archive`) or
      re.regex($e.target.url, `(?i)stream(ql|sql)|/api/archive`)
    )
    re.regex($e.target.url, `(?i)LIKE`)
    re.regex($e.target.url, `(?i)getRuntime|ProcessBuilder|exec\(|new java`)
    $e.principal.hostname = $host
  match:
    $host over 5m
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^java(\.exe)?$/i
| (ParentCommandLine=/yamcs/i OR ParentCommandLine=/org\.yamcs/i)
| in(field="ImageFileName", values=["*/sh","*/bash","*/dash","*/zsh","*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*/whoami","*/curl","*/wget","*/nc","*/ncat","*/python","*/python3","*/perl","*/ruby"], ignoreCase=true)
| table([_time, aid, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, ImageFileName, CommandLine])