Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-61667.
Upgrade to ProDetect DIRAC FileCatalog DatasetManager SQL Injection to RCE (CVE-2026-61667) in Microsoft Sentinel
Detects exploitation attempts against DIRAC's FileCatalog DatasetManager component, where a SQL injection vulnerability (CWE-89) can be chained with unsafe eval() usage (CWE-95) to achieve remote code execution. Affects DIRAC versions >=6,<8.0.79; >=8.1.0a1,<9.0.22; >=9.1.0,<9.1.10. A public PoC exists (GHSA-m4m7-4cw8-62j6). Detection focuses on anomalous SQL error signatures, injection payload patterns in DatasetManager RPC calls, and subsequent process spawning from the DIRAC service process indicative of successful eval()-based code execution.
MITRE ATT&CK
KQL Detection Query
let SuspiciousPatterns = dynamic(["UNION SELECT", "' OR '1'='1", "__import__", "os.system", "subprocess", "eval(", "exec(", "; DROP TABLE", "AND SLEEP("]);
CommonSecurityLog
| where DeviceProduct has "DIRAC" or Activity has "DatasetManager"
| where RequestURL has "FileCatalog" or Message has "DatasetManager"
| where SuspiciousPatterns has_any (extract_all(@"(?i)(union select|or '1'='1|__import__|os\.system|subprocess|eval\(|exec\(|drop table|sleep\()", Message))
| extend MatchedPattern = extract(@"(?i)(union select|or '1'='1|__import__|os\.system|subprocess|eval\(|exec\(|drop table|sleep\()", 0, Message)
| project TimeGenerated, SourceIP, DestinationIP, Message, MatchedPattern, Activity
| order by TimeGenerated descIdentifies SQL injection or Python eval/exec payload patterns in logs from DIRAC FileCatalog/DatasetManager RPC traffic ingested via CEF or custom connectors.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate dataset queries containing the substring 'union' or 'select' in metadata field names
- Automated vulnerability scanners performing authorized security assessments
- Load testing tools sending malformed queries for resilience testing
Other platforms for CVE-2026-61667
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate SQL injection payload against DatasetManager endpoint
Expected signal: HTTP request log entry on the DIRAC service showing the injected payload in the request body/message field.
- Test 2Simulate eval()-based code execution payload
Expected signal: Process creation event for a python/sh process spawned from the DIRAC service parent, with command line containing 'atomic_test_marker'.
- Test 3Simulate follow-on outbound connection from DIRAC service host
Expected signal: Network connection event from the DIRAC service account/process to an external or lab listener IP shortly after the injection attempt.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-61667 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month