PraisonAI AICoder Arbitrary File Write and Command Execution via LLM Tool Calls (CVE-2026-61445)

let suspiciousChildren = dynamic(["bash","sh","zsh","cmd.exe","powershell.exe","pwsh","nc","ncat","curl","wget","python","python3","base64","chmod"]);
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("python","python3","python.exe","uvicorn","gunicorn")
| where InitiatingProcessCommandLine has_any ("praisonai","aicoder","praisonaiagents")
| where FileName in~ (suspiciousChildren) or ProcessCommandLine has_any ("/etc/cron","authorized_keys","/tmp/","..%2f","../","bash -i","-c ")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

index=edr sourcetype="process:events" (parent_process_name IN ("python","python3","python.exe","uvicorn","gunicorn")) (parent_process="*praisonai*" OR parent_process="*aicoder*" OR parent_process="*praisonaiagents*")
| where match(process_name,"(?i)(bash|sh|zsh|cmd\.exe|powershell|pwsh|nc|ncat|curl|wget|base64|chmod)") OR match(process,"(?i)(\.\./|%2e%2e|/etc/cron|authorized_keys|bash -i|-c )")
| stats count min(_time) as firstTime max(_time) as lastTime values(process) as process_cmds by host, user, parent_process, process_name
| convert ctime(firstTime) ctime(lastTime)
| sort - count

process where event.type == "start" and
  process.parent.name in ("python","python3","python.exe","uvicorn","gunicorn") and
  stringContains(process.parent.command_line, "praisonai") and
  (
    process.name in ("bash","sh","zsh","cmd.exe","powershell.exe","pwsh","nc","ncat","curl","wget","base64","chmod") or
    process.command_line regex~ ".*(\\.\\./|/etc/cron|authorized_keys|bash -i|-c ).*"
  )

SELECT QIDNAME(qid) AS event, sourceip, username, "Process Name" AS process, "Parent Process Name" AS parent, "Process CommandLine" AS cmd FROM events WHERE "Parent Process Name" ILIKE '%python%' AND ("Parent Process CommandLine" ILIKE '%praisonai%' OR "Parent Process CommandLine" ILIKE '%aicoder%') AND ("Process Name" ILIKE '%bash%' OR "Process Name" ILIKE '%sh%' OR "Process Name" ILIKE '%curl%' OR "Process Name" ILIKE '%wget%' OR "Process Name" ILIKE '%powershell%' OR "Process CommandLine" ILIKE '%../%' OR "Process CommandLine" ILIKE '%/etc/cron%' OR "Process CommandLine" ILIKE '%authorized_keys%') ORDER BY "startTime" DESC LAST 24 HOURS

_sourceCategory=*/process ("praisonai" OR "aicoder")
| where parent_process matches "*python*"
| where process_name in ("bash","sh","zsh","cmd.exe","powershell.exe","pwsh","nc","ncat","curl","wget","base64","chmod") or command_line matches "*../*" or command_line matches "*/etc/cron*" or command_line matches "*authorized_keys*"
| count by host, user, parent_process, process_name, command_line
| sort by _count

rule praisonai_aicoder_rce_cve_2026_61445 {
  meta:
    author = "Argus"
    cve = "CVE-2026-61445"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.command_line, `(?i)praisonai|aicoder`)
    (
      $e.target.process.file.full_path = /(?i)(bash|sh|zsh|cmd\.exe|powershell|pwsh|nc|ncat|curl|wget|base64|chmod)/ nocase or
      re.regex($e.target.process.command_line, `(?i)(\.\./|/etc/cron|authorized_keys|bash -i|-c )`)
    )
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/python/i
| ParentCommandLine=/praisonai|aicoder/i
| (ImageFileName=/(bash|sh|zsh|cmd\.exe|powershell|pwsh|nc|ncat|curl|wget|base64|chmod)/i or CommandLine=/(\.\.\/|\/etc\/cron|authorized_keys|bash -i|-c )/i)
| groupBy([aid, UserName, ParentBaseFileName, ImageFileName], function=collect([CommandLine]))