SeaweedFS Unauthenticated Filer IAM gRPC S3 Admin Takeover (CVE-2026-72920)

let filerGrpcPorts = dynamic([18888, 18889, 16333]);
union isfuzzy=true CommonSecurityLog, Syslog, DeviceNetworkEvents
| where TimeGenerated > ago(1h)
| extend DestPort = coalesce(column_ifexists("DestinationPort", 0), column_ifexists("RemotePort", 0))
| extend Payload = coalesce(column_ifexists("AdditionalExtensions",""), column_ifexists("SyslogMessage",""), column_ifexists("AdditionalFields",""))
| where DestPort in (filerGrpcPorts) or Payload has_any ("filer_pb.SeaweedFiler", "iam_pb.SeaweedIdentityAccessManagement", "ConfigureS3", "CreateIdentity", "UpdateS3Credentials")
| where Payload has_any ("CreateIdentity", "ConfigureS3", "UpdateS3Credentials", "PutS3Credential", "iam_pb")
| extend SourceIP = coalesce(column_ifexists("SourceIP",""), column_ifexists("RemoteIP",""))
| where isnotempty(SourceIP) and not(ipv4_is_private(SourceIP))
| summarize CallCount=count(), Methods=make_set(Payload, 20) by SourceIP, DestPort, bin(TimeGenerated, 5m)
| where CallCount > 0

index=network OR index=proxy OR index=seaweedfs (dest_port=18888 OR dest_port=18889 OR dest_port=16333 OR grpc_method="*iam_pb*" OR grpc_method="*SeaweedIdentityAccessManagement*")
| eval body=coalesce(http2_data, payload, message)
| search body IN ("*CreateIdentity*","*ConfigureS3*","*UpdateS3Credentials*","*PutS3Credential*")
| where NOT cidrmatch("10.0.0.0/8", src_ip) AND NOT cidrmatch("192.168.0.0/16", src_ip) AND NOT cidrmatch("172.16.0.0/12", src_ip)
| stats count AS call_count values(body) AS methods by src_ip dest_ip dest_port
| where call_count > 0

sequence by source.ip with maxspan=5m
  [network where destination.port in (18888, 18889, 16333) and network.protocol == "http2"]
  [any where stringContains(message, "CreateIdentity") or stringContains(message, "ConfigureS3") or stringContains(message, "UpdateS3Credentials")]

SELECT sourceip, destinationip, destinationport, COUNT(*) AS call_count
FROM events
WHERE (destinationport IN (18888, 18889, 16333))
  AND (UTF8(payload) ILIKE '%CreateIdentity%' OR UTF8(payload) ILIKE '%ConfigureS3%' OR UTF8(payload) ILIKE '%UpdateS3Credentials%' OR UTF8(payload) ILIKE '%iam_pb%')
  AND NOT (INCIDR('10.0.0.0/8', sourceip) OR INCIDR('192.168.0.0/16', sourceip) OR INCIDR('172.16.0.0/12', sourceip))
GROUP BY sourceip, destinationip, destinationport
LAST 1 HOURS

_sourceCategory=network/seaweedfs ("CreateIdentity" OR "ConfigureS3" OR "UpdateS3Credentials" OR "iam_pb" OR "SeaweedIdentityAccessManagement")
| where dest_port in (18888, 18889, 16333) OR grpc_method matches "*iam_pb*"
| where !(src_ip matches "10.*" or src_ip matches "192.168.*" or src_ip matches "172.1[6-9].*" or src_ip matches "172.2*" or src_ip matches "172.3[0-1].*")
| count as call_count by src_ip, dest_ip, dest_port
| where call_count > 0

rule seaweedfs_cve_2026_72920_iam_grpc {
  meta:
    author = "Argus"
    description = "Unauthenticated SeaweedFS filer IAM gRPC S3 admin takeover"
    cve = "CVE-2026-72920"
    severity = "CRITICAL"
  events:
    $e.network.ip_protocol = "TCP"
    ($e.target.port = 18888 or $e.target.port = 18889 or $e.target.port = 16333)
    (
      $e.metadata.description = /CreateIdentity/ nocase or
      $e.metadata.description = /ConfigureS3/ nocase or
      $e.metadata.description = /UpdateS3Credentials/ nocase or
      $e.metadata.description = /iam_pb/ nocase
    )
    $src = $e.principal.ip
  match:
    $src over 5m
  condition:
    $e
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkReceiveAcceptIP4
| RemotePort=18888 OR RemotePort=18889 OR RemotePort=16333 OR LocalPort=18888 OR LocalPort=18889 OR LocalPort=16333
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","192.168.0.0/16","172.16.0.0/12"])
| groupBy([RemoteAddressIP4, LocalPort], function=count(as=conn_count))
| conn_count > 5