Gitea Code Injection (CVE-2026-60004) Exploitation

let giteaBinaries = dynamic(["gitea", "gitea.exe"]);
let suspiciousChildren = dynamic(["bash","sh","dash","zsh","python","python3","perl","ruby","php","node","powershell.exe","cmd.exe","curl","wget","nc","ncat","whoami","id"]);
DeviceProcessEvents
| where InitiatingProcessFileName in~ (giteaBinaries)
| where FileName in~ (suspiciousChildren)
| where not(ProcessCommandLine has_any ("git-upload-pack","git-receive-pack","git-upload-archive","hooks/pre-receive","hooks/post-receive","hooks/update") and FileName in~ ("bash","sh"))
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessAccountName
| order by Timestamp desc

index=edr (process_name IN ("bash","sh","dash","zsh","python","python3","perl","ruby","php","node","powershell.exe","cmd.exe","curl","wget","nc","ncat"))
| where match(parent_process_name, "(?i)^gitea(\.exe)?$")
| search NOT parent_process="*git-receive-pack*" NOT parent_process="*git-upload-pack*"
| stats count min(_time) as firstTime max(_time) as lastTime values(process) as commands by host parent_process_name process_name user
| convert ctime(firstTime) ctime(lastTime)
| sort - lastTime

process where event.type == "start" and
  process.parent.name : ("gitea", "gitea.exe") and
  process.name : ("bash","sh","dash","zsh","python","python3","perl","ruby","php","node","powershell.exe","cmd.exe","curl","wget","nc","ncat","whoami","id") and
  not process.command_line : ("*git-receive-pack*", "*git-upload-pack*", "*hooks/pre-receive*", "*hooks/post-receive*")

SELECT QIDNAME(qid) AS event, "parentProcessName", "processName", "commandLine", username, sourceip, destinationip, DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS time FROM events WHERE LOWER("parentProcessName") LIKE '%gitea%' AND LOWER("processName") IN ('bash','sh','dash','zsh','python','python3','perl','ruby','php','node','powershell.exe','cmd.exe','curl','wget','nc','ncat') AND "commandLine" NOT LIKE '%git-receive-pack%' AND "commandLine" NOT LIKE '%git-upload-pack%' ORDER BY devicetime DESC LAST 24 HOURS

_sourceCategory=*endpoint* ("gitea")
| json field=_raw "parent_process_name", "process_name", "command_line", "user", "host" nodrop
| where tolowercase(parent_process_name) matches "gitea*"
| where tolowercase(process_name) in ("bash","sh","dash","zsh","python","python3","perl","ruby","php","node","powershell.exe","cmd.exe","curl","wget","nc","ncat")
| where !(command_line matches "*git-receive-pack*") and !(command_line matches "*git-upload-pack*")
| count by host, parent_process_name, process_name, user, command_line
| sort by _count desc

rule gitea_code_injection_cve_2026_60004 {
  meta:
    author = "Argus"
    description = "Gitea code injection (CVE-2026-60004) - server spawns interpreter/shell"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)gitea(\.exe)?$`)
    $e.target.process.file.full_path = /(?i)(bash|sh|dash|zsh|python3?|perl|ruby|php|node|powershell\.exe|cmd\.exe|curl|wget|nc|ncat)$/
    not $e.target.process.command_line = /git-(receive|upload)-pack/
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^gitea(\.exe)?$/i
| in(field="ImageFileName", values=["bash","sh","dash","zsh","python","python3","perl","ruby","php","node","powershell.exe","cmd.exe","curl","wget","nc","ncat"], ignoreCase=true)
| CommandLine!=/git-(receive|upload)-pack/i
| groupBy([aid, ComputerName, ParentBaseFileName, ImageFileName, UserName, CommandLine], function=count())
| sort(count, order=desc)