Balbooa Forms Unrestricted File Upload Exploitation (CVE-2026-56291)

// Microsoft Sentinel - Detect Balbooa Forms webshell upload / RCE attempt (CVE-2026-56291)
let suspiciousExt = dynamic([".php",".phtml",".phar",".php5",".php7",".pht",".jsp",".asp",".aspx"]);
W3CIISLog
| where csUriStem has_any ("/components/com_balbooaforms", "/media/com_balbooaforms", "joomla") and cUriQuery has_any ("upload", "file")
| where csMethod == "POST"
| where cUriStem has_any (suspiciousExt)
| extend UploadedFile = extract(@"([^/\\]+\.(php\d?|phtml|phar|pht|jsp|asp|aspx))", 1, csUriStem)
| project TimeGenerated, cIP, csUriStem, csUserAgent, scStatus, UploadedFile
| union (
    W3CIISLog
    | where cUriStem has "com_balbooaforms" and csMethod == "POST" and scStatus in (200,201,302)
    | project TimeGenerated, cIP, csUriStem, csUserAgent, scStatus, UploadedFile="unknown"
)
| sort by TimeGenerated desc

index=web sourcetype=access_combined OR sourcetype=iis
(uri_path="*com_balbooaforms*" OR uri_path="*balbooa*")
method=POST
| rex field=uri_path "(?<uploaded_file>[^/\\\\]+\.(?<ext>php\d?|phtml|phar|pht|jsp|asp|aspx))"
| where isnotnull(ext)
| stats count min(_time) as first_seen max(_time) as last_seen by clientip, uri_path, uploaded_file, status, http_user_agent
| where count > 0

any where event.dataset in ("nginx.access", "apache.access", "iis.access") and
  http.request.method == "POST" and
  url.path : ("*com_balbooaforms*", "*balbooaforms*") and
  url.path : ("*.php", "*.phtml", "*.phar", "*.pht", "*.jsp", "*.asp", "*.aspx")

SELECT sourceip, destinationip, "URL" AS url, "HTTP Method" AS method, UTF8(payload) AS payload_text
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%web%'
AND "HTTP Method" = 'POST'
AND ("URL" ILIKE '%com_balbooaforms%' OR "URL" ILIKE '%balbooaforms%')
AND ("URL" ILIKE '%.php%' OR "URL" ILIKE '%.phtml%' OR "URL" ILIKE '%.phar%' OR "URL" ILIKE '%.pht%' OR "URL" ILIKE '%.jsp%' OR "URL" ILIKE '%.asp%')
LAST 24 HOURS

_sourceCategory=web/access
| json field=_raw "method", "url_path", "client_ip", "status" as method, url_path, client_ip, status nodrop
| where method="POST"
| where url_path matches "*com_balbooaforms*" or url_path matches "*balbooaforms*"
| where url_path matches "*.php*" or url_path matches "*.phtml*" or url_path matches "*.phar*" or url_path matches "*.pht*" or url_path matches "*.jsp*" or url_path matches "*.asp*"
| count by client_ip, url_path, status
| sort by _count

rule balbooa_forms_cve_2026_56291_upload {
  meta:
    author = "df00tech detection engineering"
    description = "Detects exploitation of CVE-2026-56291 - Balbooa Forms unrestricted file upload"
    severity = "HIGH"
    cve = "CVE-2026-56291"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = "POST"
    (re.regex($e.target.url, `(?i)(com_balbooaforms|balbooaforms)`))
    (re.regex($e.target.url, `(?i)\.(php\d?|phtml|phar|pht|jsp|asp|aspx)`))
  outcome:
    $risk_score = 75
  condition:
    $e
}

#event_simpleName=HttpRequest
| method="POST"
| url=/com_balbooaforms|balbooaforms/i
| url=/\.(php\d?|phtml|phar|pht|jsp|asp|aspx)/i
| table([_time, ClientIP, url, method, StatusCode])
| sort(_time, order=desc)