Which SIEM platforms have a CVE-2026-56291 detection rule?

df00tech provides CVE-2026-56291 (Balbooa Forms Unrestricted File Upload Exploitation (CVE-2026-56291)) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the CVE-2026-56291 detection?

The CVE-2026-56291 detection is rated high severity with medium confidence.

What are common false positives for CVE-2026-56291?

Common false positives for CVE-2026-56291 include: Legitimate file uploads with similarly named but benign attachments (e.g. .php in a filename used decoratively); Internal QA/testing of the forms component uploading test files; Misconfigured logging causing false extension matches from query strings.

CVE-2026-56291 Elastic Security · Elastic

Detect Balbooa Forms Unrestricted File Upload Exploitation (CVE-2026-56291) in Elastic Security

Q: What data sources are required to detect Balbooa Forms Unrestricted File Upload Exploitation (CVE-2026-56291) (CVE-2026-56291)?

Detecting Balbooa Forms Unrestricted File Upload Exploitation (CVE-2026-56291) requires the following data sources: IIS Logs, Web Application Firewall Logs, Azure WAF.

Detects exploitation attempts against CVE-2026-56291, an unrestricted upload of file with dangerous type vulnerability (CWE-434) in Balbooa Forms for Joomla. This vulnerability is listed in CISA KEV, indicating confirmed active exploitation. Attackers abuse the forms file upload functionality to upload web shells or other malicious executable content (PHP, PHTML, PHAR, etc.) bypassing extension/type restrictions, leading to remote code execution on the underlying web server.

MITRE ATT&CK

Tactic: Initial Access Execution

Elastic Detection Query

Elastic Security (Elastic)

eql

any where event.dataset in ("nginx.access", "apache.access", "iis.access") and
  http.request.method == "POST" and
  url.path : ("*com_balbooaforms*", "*balbooaforms*") and
  url.path : ("*.php", "*.phtml", "*.phar", "*.pht", "*.jsp", "*.asp", "*.aspx")

high severity medium confidence

Detects POST requests to Balbooa Forms Joomla component with dangerous file extensions in the URI path, indicative of unrestricted file upload exploitation for CVE-2026-56291.

Data Sources

Web server access logsElastic Agent HTTP module

Required Tables

logs-nginx.access-*logs-apache.access-*logs-iis.access-*

False Positives & Tuning

Scanner traffic from authorized pentests
Legitimate uploads referencing php-like substrings in filename metadata
Proxy rewrite rules altering URI paths and matching pattern coincidentally

Other platforms for CVE-2026-56291

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Simulate dangerous file extension upload POST request
Expected signal: Web server access log entry showing POST request to com_balbooaforms upload endpoint with filename test_shell.php and 200/201 status code.
Test 2Upload double-extension bypass file (.phtml)
Expected signal: Web access log entry for POST request with mismatched Content-Type (image/jpeg) and .phtml extension in filename.
Test 3Windows IIS-hosted Joomla upload simulation
Expected signal: W3CIISLog entry recording POST to com_balbooaforms endpoint with cs-uri-stem containing test_shell.aspx.

Last updated: 2026-07-11 Research depth: standard

References (4)

Response Playbook

Triage

Identify the affected Joomla site(s) running the Balbooa Forms component and confirm the installed version against the vendor's patched release.
Search web server access logs for POST requests to com_balbooaforms upload endpoints with dangerous extensions (.php, .phtml, .phar, .pht, .jsp, .asp, .aspx) over the last 30 days.
Inspect the web root and any Joomla media/uploads directories for recently created or modified files with executable extensions or suspicious naming patterns.
Check for webshell indicators in uploaded files (e.g., eval(), base64_decode(), system() calls) using YARA or manual review.
Review server process lists and cron jobs for anomalous PHP-CLI or shell processes spawned by the web server user (www-data, apache, iis apppool).

Containment

Immediately disable or restrict the Balbooa Forms file upload functionality (remove/rename the component or block the upload endpoint at the WAF/reverse proxy) until patched.
Isolate the affected web server from sensitive internal network segments and rotate any credentials/API keys accessible from that host.
Apply vendor patch/update to Balbooa Forms to a non-vulnerable version, or deploy a WAF rule blocking POSTs with executable file extensions to the component endpoint.
Remove any identified webshells or malicious uploaded files and restore affected files from known-good backups.

Evidence Collection

Preserve full web server access and error logs, including raw HTTP request bodies for the relevant time window, before rotation/purge.
Collect file system timestamps (created/modified/accessed), hashes, and full copies of any suspicious uploaded files for forensic analysis and IOC extraction.
Capture memory and process snapshots of the web server host if active compromise/persistence is suspected.
Export Joomla component configuration and database records related to form submissions for correlation with attacker activity.

Escalation Criteria

!Confirmed webshell or RCE artifact found on an internet-facing production server.
!Evidence of lateral movement, credential harvesting, or data exfiltration originating from the compromised web server.
!Multiple distinct source IPs attempting exploitation, suggesting mass scanning/automated KEV exploitation campaigns.
!Affected system hosts regulated or sensitive data (PII, PCI, PHI) subject to breach notification requirements.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

>Web server access/error logs showing POST requests to com_balbooaforms upload endpoints
>Newly created files with executable extensions in Joomla media/uploads directories with anomalous timestamps
>Web shell files containing obfuscated PHP code (eval, base64_decode, system, exec)
>Joomla database records in the forms submission tables referencing the malicious upload

Tuning Guidance

Baseline normal file upload patterns for the Balbooa Forms component in your environment (legitimate file types, average upload volume per IP) to reduce false positives from valid CMS usage. Exclude known internal QA/testing IP ranges. Tighten extension matching to only executable/script types rather than broad wildcard matches, and correlate upload events with subsequent HTTP GET requests to the uploaded file path to confirm the webshell was actually invoked (higher-fidelity detection).

Hunting Queries

Hunts for source IPs making repeated successful POST requests to Balbooa Forms endpoints, indicating scanning or repeated exploitation attempts.

Hunting — KQL

kql

W3CIISLog
| where csUriStem has "com_balbooaforms" and csMethod == "POST"
| where scStatus == 200
| summarize count(), makeset(csUriStem) by cIP
| where count_ > 3
| sort by count_ desc

Hunting — SPL

spl

index=web uri_path="*com_balbooaforms*" method=POST status=200
| stats count values(uri_path) as paths by clientip
| where count > 3
| sort -count

Atomic Red Team Tests

Test 1 Simulate dangerous file extension upload POST request

linux

Sends a crafted multipart/form-data POST request to a lab Joomla Balbooa Forms upload endpoint containing a file with a .php extension to validate detection logic.

Command

bash

curl -s -X POST -F "file=@/tmp/test_shell.php;filename=test_shell.php;type=application/x-php" http://lab-target/index.php?option=com_balbooaforms&task=form.upload

Cleanup

bash

rm -f /tmp/test_shell.php; ssh lab-target 'rm -f /var/www/html/media/com_balbooaforms/uploads/test_shell.php'

Expected Telemetry

Web server access log entry showing POST request to com_balbooaforms upload endpoint with filename test_shell.php and 200/201 status code.

Expected Detection

KQL/SPL rule fires on POST request containing .php extension in uploaded filename to Balbooa Forms endpoint.

Test 2 Upload double-extension bypass file (.phtml)

linux

Tests detection against extension bypass techniques by uploading a file with a .phtml extension, commonly used to evade naive .php extension filters.

Command

bash

curl -s -X POST -F "file=@/tmp/test_shell.phtml;filename=test_shell.phtml;type=image/jpeg" http://lab-target/index.php?option=com_balbooaforms&task=form.upload

Cleanup

bash

rm -f /tmp/test_shell.phtml; ssh lab-target 'rm -f /var/www/html/media/com_balbooaforms/uploads/test_shell.phtml'

Expected Telemetry

Web access log entry for POST request with mismatched Content-Type (image/jpeg) and .phtml extension in filename.

Expected Detection

Detection rule flags the .phtml extension in uri_path/filename despite spoofed MIME type header.

Test 3 Windows IIS-hosted Joomla upload simulation

windows

Simulates the same unrestricted upload exploitation against an IIS-hosted Joomla lab instance to validate Windows-based W3CIISLog detection coverage.

Command

powershell

Invoke-WebRequest -Uri "http://lab-target-iis/index.php?option=com_balbooaforms&task=form.upload" -Method Post -Form @{file=Get-Item 'C:\temp\test_shell.aspx'}

Cleanup

powershell

Remove-Item C:\temp\test_shell.aspx -Force; Invoke-Command -ComputerName lab-target-iis -ScriptBlock { Remove-Item 'C:\inetpub\wwwroot\media\com_balbooaforms\uploads\test_shell.aspx' -Force -ErrorAction SilentlyContinue }

Expected Telemetry

W3CIISLog entry recording POST to com_balbooaforms endpoint with cs-uri-stem containing test_shell.aspx.

Expected Detection

KQL detection rule matches the .aspx extension within the IIS log cs-uri-stem field for the Balbooa Forms component path.

Related Detections

Tactic Hubs

TA0001Initial Access TA0002Execution

Related Techniques

T1190Exploit Public-Facing Application T1505.003Web Shell T1105Ingress Tool Transfer

Detect Balbooa Forms Unrestricted File Upload Exploitation (CVE-2026-56291) in Elastic Security

MITRE ATT&CK

Elastic Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2026-56291

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

MITRE ATT&CK

Elastic Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2026-56291

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox