Detect Crawl4AI Docker API Multiple Critical Vulnerabilities (File Write, SSRF, Auth Bypass, XSS, JS Execution) in Google Chronicle

rule crawl4ai_exploit_attempt {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation of CVE-2026-56266 Crawl4AI multiple vulnerabilities"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-365w-hqf6-vxfg"
    version = "1.0"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.port in (11235, 8080, 8000, 8001)
    (
      re.regex($e.network.http.request_url, `(?i)/(?:crawl|execute_js|screenshot|extract|batch)`) or
      re.regex($e.network.http.request_url, `(?i)(\.\./|%2e%2e|%252e%252e|file://|gopher://|169\.254\.169\.254)`) or
      re.regex($e.network.http.request_url, `(?i)(<script|javascript:|onerror=|onload=)`)
    )
    $ip = $e.principal.ip

  match:
    $ip over 5m

  outcome:
    $risk_score = max(
      if(re.regex($e.network.http.request_url, `169\.254\.169\.254|file://`), 95,
      if(re.regex($e.network.http.request_url, `execute_js|%2e%2e|\.\./`), 85, 70))
    )
    $threat_type = array_distinct(
      if(re.regex($e.network.http.request_url, `(?i)(\.\./|%2e%2e)`), "PathTraversal",
      if(re.regex($e.network.http.request_url, `169\.254\.169\.254`), "SSRF-CloudMetadata",
      if(re.regex($e.network.http.request_url, `execute_js`), "JSExecution", "Other")))
    )

  condition:
    $e
}