Flyto2 Core Arbitrary File Write via image.download Path Traversal (CVE-2026-67429)

let SuspiciousPatterns = dynamic(["..%2f", "..%252f", "..\\\\", "../../", "..%5c", "%2e%2e%2f", "%2e%2e/"]);
let FlytoProc = ProcessCreationEvents
| where FileName has_any ("python", "python3", "gunicorn", "uwsgi", "flyto")
| where ProcessCommandLine has "flyto";
DeviceProcessEvents
| where InitiatingProcessFileName has_any ("python", "python3", "gunicorn", "uwsgi")
| where ProcessCommandLine has "image.download" or ProcessCommandLine has "flyto"
| where ProcessCommandLine has_any (SuspiciousPatterns) or ProcessCommandLine matches regex @"(?i)(\.\.\/){2,}|(\.\.\\\\){2,}"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| union (
DeviceFileEvents
| where InitiatingProcessCommandLine has "flyto" or InitiatingProcessFileName has_any ("python", "python3", "gunicorn", "uwsgi")
| where FolderPath has_any ("/etc/", "/root/.ssh/", "C:\\Windows\\", "authorized_keys", "/var/www/", "/etc/cron.d/", "wwwroot", "inetpub")
| where ActionType in ("FileCreated", "FileModified")
| project TimeGenerated, DeviceName, AccountName=InitiatingProcessAccountName, ProcessCommandLine=InitiatingProcessCommandLine, InitiatingProcessFileName, FolderPath, FileName
)
| sort by TimeGenerated desc

index=* (sourcetype=linux_secure OR sourcetype=WinEventLog:Security OR sourcetype=*process* OR sourcetype=*file*)
(process_name="python*" OR process_name="python3*" OR process_name="gunicorn" OR process_name="uwsgi") 
(CommandLine="*flyto*" OR CommandLine="*image.download*")
| eval traversal=if(match(CommandLine, "(\.\.\/){2,}|(\.\.\\\\){2,}|%2e%2e%2f|%2e%2e/"), 1, 0)
| where traversal=1
| table _time, host, user, process_name, CommandLine
| append [
 search index=* sourcetype=*file* (file_path="*/etc/*" OR file_path="*/root/.ssh/*" OR file_path="*authorized_keys*" OR file_path="*cron.d*" OR file_path="*C:\\Windows*" OR file_path="*wwwroot*" OR file_path="*inetpub*") (parent_process_name="python*" OR parent_process_name="gunicorn" OR parent_process_name="uwsgi")
  | table _time, host, user, parent_process_name, file_path
]
| sort - _time

sequence by host.name with maxspan=5m
  [process where event.type == "start" and
    (process.name : "python*" or process.name : "gunicorn" or process.name : "uwsgi") and
    process.command_line : ("*flyto*", "*image.download*") and
    process.command_line : ("*../*", "*..\\*", "*%2e%2e%2f*", "*%2e%2e/*")]
  [file where event.type in ("creation", "change") and
    (file.path : "/etc/*" or file.path : "/root/.ssh/*" or file.path : "*authorized_keys*" or file.path : "*cron.d*" or file.path : "C:\\Windows\\*" or file.path : "*wwwroot*" or file.path : "*inetpub*")]

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime, sourceip, username, "Process Command Line" AS CommandLine, "File Name" AS FilePath
FROM events
WHERE ("Process Command Line" ILIKE '%flyto%' OR "Process Command Line" ILIKE '%image.download%')
AND ("Process Command Line" ILIKE '%../../%' OR "Process Command Line" ILIKE '%..\\%' OR "Process Command Line" ILIKE '%25%2e%25%2e%2f%' OR "Process Command Line" ILIKE '%2e%2e%2f%')
AND QIDNAME(qid) IN ('Process Created', 'File Created', 'File Modified')
LAST 24 HOURS

_sourceCategory=*process* OR _sourceCategory=*file*
| where CommandLine matches "*flyto*" or CommandLine matches "*image.download*"
| parse regex field=CommandLine "(?<traversal>(\.\.\/){2,}|(\.\.\\\\){2,}|%2e%2e%2f|%2e%2e\/)" nodrop
| where !isNull(traversal)
| fields _messagetime, hostname, user, CommandLine, traversal
| sort by _messagetime desc

rule flyto_core_path_traversal_write {
  meta:
    author = "argus-detection-platform"
    description = "Detects CVE-2026-67429 exploitation via path traversal in flyto-core image.download"
    severity = "CRITICAL"
  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.target.process.command_line = /(?i).*(flyto|image\.download).*/
    $proc.target.process.command_line = /(\.\.\/){2,}|(\.\.\\){2,}|%2e%2e%2f|%2e%2e\//
    $file.metadata.event_type = "FILE_CREATION"
    $file.target.file.full_path = /(?i).*(\/etc\/|\/root\/\.ssh\/|authorized_keys|cron\.d|windows\\|wwwroot|inetpub).*/
    $proc.principal.hostname = $file.principal.hostname
  match:
    $proc.principal.hostname over 5m
  condition:
    $proc and $file
}

#event_simpleName=ProcessRollup2
| CommandLine=/.*flyto.*|.*image\.download.*/i
| CommandLine=/(\.\.\/){2,}|(\.\.\\){2,}|%2e%2e%2f|%2e%2e\//i
| join(
    query={#event_simpleName=/FileWritten|FileCreateInfo/ ImageFileName=/etc\/|root\/\.ssh\/|authorized_keys|cron\.d|windows\\|wwwroot|inetpub/i},
    field=aid, key=aid, mode=inner
  )
| table([_time, aid, ComputerName, UserName, CommandLine, ImageFileName])
| sort(_time, order=desc)