Detect Flyto2 Core Arbitrary File Write via image.download Path Traversal (CVE-2026-67429) in Microsoft Sentinel

let SuspiciousPatterns = dynamic(["..%2f", "..%252f", "..\\\\", "../../", "..%5c", "%2e%2e%2f", "%2e%2e/"]);
let FlytoProc = ProcessCreationEvents
| where FileName has_any ("python", "python3", "gunicorn", "uwsgi", "flyto")
| where ProcessCommandLine has "flyto";
DeviceProcessEvents
| where InitiatingProcessFileName has_any ("python", "python3", "gunicorn", "uwsgi")
| where ProcessCommandLine has "image.download" or ProcessCommandLine has "flyto"
| where ProcessCommandLine has_any (SuspiciousPatterns) or ProcessCommandLine matches regex @"(?i)(\.\.\/){2,}|(\.\.\\\\){2,}"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| union (
DeviceFileEvents
| where InitiatingProcessCommandLine has "flyto" or InitiatingProcessFileName has_any ("python", "python3", "gunicorn", "uwsgi")
| where FolderPath has_any ("/etc/", "/root/.ssh/", "C:\\Windows\\", "authorized_keys", "/var/www/", "/etc/cron.d/", "wwwroot", "inetpub")
| where ActionType in ("FileCreated", "FileModified")
| project TimeGenerated, DeviceName, AccountName=InitiatingProcessAccountName, ProcessCommandLine=InitiatingProcessCommandLine, InitiatingProcessFileName, FolderPath, FileName
)
| sort by TimeGenerated desc