TrueConf Server Code Injection (CVE-2026-72530)

let tcParents = dynamic(["trueconf.exe","mcu.exe","trueconf_server.exe","vcs.exe","webmanager.exe","tcserver.exe"]);
let suspChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","bash.exe","whoami.exe","net.exe","net1.exe","nltest.exe","certutil.exe","bitsadmin.exe"]);
DeviceProcessEvents
| where InitiatingProcessFileName in~ (tcParents)
| where FileName in~ (suspChildren)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, AccountDomain, ProcessId
| order by Timestamp desc

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval pp=lower(ParentImage), ci=lower(Image)
| where like(pp,"%trueconf%") OR like(pp,"%mcu.exe") OR like(pp,"%vcs.exe") OR like(pp,"%tcserver.exe") OR like(pp,"%webmanager.exe")
| where match(ci,"(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|bash|whoami|net1?|nltest|certutil|bitsadmin)\.exe$")
| table _time host ParentImage ParentCommandLine Image CommandLine User
| sort - _time

process where event.type == "start" and
  stringContains~(process.parent.name, "trueconf") == true or
  process.parent.name : ("mcu.exe","vcs.exe","tcserver.exe","webmanager.exe","trueconf.exe") and
  process.name : ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","whoami.exe","net.exe","net1.exe","nltest.exe","certutil.exe","bitsadmin.exe")

SELECT QIDNAME(qid) AS event, "Process Name" AS child_process, "Parent Process Name" AS parent_process, "Command Line" AS command_line, username, sourceip, starttime
FROM events
WHERE LOWER("Parent Process Name") LIKE '%trueconf%' OR LOWER("Parent Process Name") LIKE '%mcu.exe' OR LOWER("Parent Process Name") LIKE '%vcs.exe' OR LOWER("Parent Process Name") LIKE '%webmanager.exe'
AND (LOWER("Process Name") LIKE '%cmd.exe' OR LOWER("Process Name") LIKE '%powershell.exe' OR LOWER("Process Name") LIKE '%pwsh.exe' OR LOWER("Process Name") LIKE '%wscript.exe' OR LOWER("Process Name") LIKE '%cscript.exe' OR LOWER("Process Name") LIKE '%certutil.exe' OR LOWER("Process Name") LIKE '%rundll32.exe' OR LOWER("Process Name") LIKE '%whoami.exe')
ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*windows* ("Microsoft-Windows-Sysmon" OR EventID=1)
| json field=_raw "Image", "ParentImage", "CommandLine", "User" nodrop
| toLowerCase(ParentImage) as parent
| toLowerCase(Image) as child
| where parent matches "*trueconf*" or parent matches "*mcu.exe" or parent matches "*vcs.exe" or parent matches "*webmanager.exe"
| where child matches "*cmd.exe" or child matches "*powershell.exe" or child matches "*pwsh.exe" or child matches "*wscript.exe" or child matches "*cscript.exe" or child matches "*certutil.exe" or child matches "*rundll32.exe" or child matches "*whoami.exe"
| count by ParentImage, Image, CommandLine, User
| sort by _count

rule trueconf_cve_2026_72530_code_injection {
  meta:
    author = "Argus"
    description = "TrueConf Server spawning shell/LOLBin children - CVE-2026-72530 code injection"
    severity = "CRITICAL"
    cve = "CVE-2026-72530"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)(trueconf|mcu\.exe|vcs\.exe|webmanager\.exe|tcserver\.exe)`)
    re.regex($e.principal.process.file.full_path, `(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|bitsadmin|whoami|nltest)\.exe$`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/trueconf|mcu\.exe|vcs\.exe|webmanager\.exe|tcserver\.exe/i
| FileName=/^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|bitsadmin|whoami|net1?|nltest)\.exe$/i
| table([@timestamp, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName])
| sort(@timestamp, order=desc)