Semaphore UI OS Command Injection (CVE-2026-73294)

let semaphoreParents = dynamic(["semaphore", "semaphore-server", "semaphore_linux_amd64"]);
let shellChildren = dynamic(["sh", "bash", "dash", "zsh", "cmd.exe", "powershell.exe", "pwsh"]);
DeviceProcessEvents
| where InitiatingProcessFileName has_any (semaphoreParents)
| where FileName in~ (shellChildren)
| where ProcessCommandLine has_any (";", "&&", "||", "|", "`", "$(", "${", "\n")
    or ProcessCommandLine has_any ("curl ", "wget ", "nc ", "/dev/tcp/", "bash -i", "python -c", "chmod +x")
| project Timestamp, DeviceId, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessAccountName
| order by Timestamp desc

index=* sourcetype IN ("linux:process", "Sysmon:WinEventLog", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval parent=lower(coalesce(parent_process_name, ParentImage))
| eval child=lower(coalesce(process_name, Image))
| where like(parent, "%semaphore%")
| where match(child, "(sh|bash|dash|zsh|cmd\.exe|powershell\.exe|pwsh)$")
| eval cmd=coalesce(process, CommandLine)
| where match(cmd, "[;&`|]|\$\(|\$\{|/dev/tcp/|bash -i|nc |curl |wget |python -c|chmod \+x")
| table _time host parent child cmd user
| sort - _time

process where event.type == "start" and
  process.parent.name like~ ("semaphore*") and
  process.name in ("sh", "bash", "dash", "zsh", "cmd.exe", "powershell.exe", "pwsh") and
  (
    process.command_line regex~ ".*([;&`|]|\$\(|\$\{).*" or
    process.command_line like~ ("*bash -i*", "*/dev/tcp/*", "*curl *", "*wget *", "*nc *", "*python -c*", "*chmod +x*")
  )

SELECT QIDNAME(qid) AS event, "parentProcessName", "Process Name" AS processName, "Process CommandLine" AS commandLine, username, sourceip, devicetime
FROM events
WHERE LOWER("parentProcessName") ILIKE '%semaphore%'
  AND (LOWER("Process Name") ILIKE '%sh' OR LOWER("Process Name") ILIKE '%bash' OR LOWER("Process Name") ILIKE '%cmd.exe' OR LOWER("Process Name") ILIKE '%powershell.exe' OR LOWER("Process Name") ILIKE '%pwsh')
  AND ("Process CommandLine" IMATCHES '.*([;&`|]|\$\(|\$\{|/dev/tcp/|bash -i|curl |wget |nc |python -c|chmod \+x).*')
ORDER BY devicetime DESC LAST 24 HOURS

_sourceCategory=*process* OR _sourceCategory=*sysmon* OR _sourceCategory=*auditd*
| where tolowercase(parent_process_name) matches "*semaphore*"
| where tolowercase(process_name) matches /(sh|bash|dash|zsh|cmd\.exe|powershell\.exe|pwsh)$/
| where command_line matches /[;&`|]|\$\(|\$\{|\/dev\/tcp\/|bash -i|curl |wget |nc |python -c|chmod \+x/
| fields _messagetime, host, parent_process_name, process_name, command_line, user
| sort by _messagetime desc

rule semaphore_cve_2026_73294_cmd_injection {
  meta:
    author = "Argus Detection Platform"
    description = "Semaphore UI OS command injection (CVE-2026-73294) - Semaphore parent spawning shell with injection metacharacters"
    severity = "CRITICAL"
    reference = "GHSA-xp7j-h7jc-4w8p"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)semaphore`)
    re.regex($e.target.process.file.full_path, `(?i)(sh|bash|dash|zsh|cmd\.exe|powershell\.exe|pwsh)$`)
    re.regex($e.target.process.command_line, `[;&\x60|]|\$\(|\$\{|/dev/tcp/|bash -i|curl |wget |nc |python -c|chmod \+x`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/semaphore/i
| in(field="ImageFileName", values=["*/sh", "*/bash", "*/dash", "*/zsh", "*cmd.exe", "*powershell.exe", "*pwsh"], ignoreCase=true)
| CommandLine=/[;&`|]|\$\(|\$\{|\/dev\/tcp\/|bash -i|curl |wget |nc |python -c|chmod \+x/
| table([@timestamp, aid, ComputerName, ParentBaseFileName, ImageFileName, CommandLine, UserName])