DIRAC FileCatalog DatasetManager SQL Injection to RCE (CVE-2026-61667)

let SuspiciousPatterns = dynamic(["UNION SELECT", "' OR '1'='1", "__import__", "os.system", "subprocess", "eval(", "exec(", "; DROP TABLE", "AND SLEEP("]);
CommonSecurityLog
| where DeviceProduct has "DIRAC" or Activity has "DatasetManager"
| where RequestURL has "FileCatalog" or Message has "DatasetManager"
| where SuspiciousPatterns has_any (extract_all(@"(?i)(union select|or '1'='1|__import__|os\.system|subprocess|eval\(|exec\(|drop table|sleep\()", Message))
| extend MatchedPattern = extract(@"(?i)(union select|or '1'='1|__import__|os\.system|subprocess|eval\(|exec\(|drop table|sleep\()", 0, Message)
| project TimeGenerated, SourceIP, DestinationIP, Message, MatchedPattern, Activity
| order by TimeGenerated desc

index=dirac OR sourcetype=dirac:filecatalog
| regex message="(?i)(union\s+select|or\s+'1'='1|__import__|os\.system|subprocess|eval\(|exec\(|drop\s+table|sleep\()"
| rex field=message "(?i)(?<matched_pattern>union select|or '1'='1|__import__|os\.system|subprocess|eval\(|exec\(|drop table|sleep\()"
| stats count by src_ip, dest_ip, matched_pattern, _time
| where count > 0
| sort -_time

sequence by process.parent.name with maxspan=1m
  [network where destination.port == 9197 or destination.port == 9198 and
    network.protocol == "http" and
    http.request.body.content : ("*UNION SELECT*", "*' OR '1'='1*", "*__import__*", "*os.system*", "*subprocess*", "*eval(*", "*exec(*")]
  [process where process.name : ("python*", "sh", "bash") and process.parent.name : "dirac*"]

SELECT sourceip, destinationip, UTF8(payload) AS payload_text, starttime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%DIRAC%'
AND (UTF8(payload) ILIKE '%UNION SELECT%'
  OR UTF8(payload) ILIKE '%'' OR ''1''=''1%'
  OR UTF8(payload) ILIKE '%__import__%'
  OR UTF8(payload) ILIKE '%os.system%'
  OR UTF8(payload) ILIKE '%subprocess%'
  OR UTF8(payload) ILIKE '%eval(%'
  OR UTF8(payload) ILIKE '%exec(%')
LAST 24 HOURS

_sourceCategory=dirac/filecatalog
| parse "message=*" as message
| where message matches "*UNION SELECT*" or message matches "*' OR '1'='1*" or message matches "*__import__*" or message matches "*os.system*" or message matches "*subprocess*" or message matches "*eval(*" or message matches "*exec(*"
| count by src_ip, dest_ip
| sort -_count

rule dirac_datasetmanager_sqli_rce {
  meta:
    author = "df00tech"
    description = "Detects CVE-2026-61667 DIRAC DatasetManager SQLi to RCE attempt"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.process.file.full_path = /(?i).*dirac.*/
    $e.network.http.request.body_text = /(?i)(union select|or '1'='1|__import__|os\.system|subprocess|eval\(|exec\()/
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/dirac/i
| in(field=FileName, values=["python*", "python3*", "sh", "bash"])
| join(query={#event_simpleName=NetworkConnectIP4 | RemotePort=9197 OR RemotePort=9198}, field=aid, key=aid, mode=inner)
| table([ComputerName, ParentBaseFileName, FileName, CommandLine, RemoteAddressIP4, RemotePort, timestamp])