Arista EOS Incomplete Comparison Authentication Bypass (CVE-2026-7473)

let AristaDevices = DeviceNetworkEvents
| where RemotePort in (22, 443, 80, 8080, 8443)
| summarize AristaIPs = make_set(RemoteIP) by DeviceName;
let SuspiciousLogins = SigninLogs
| where AppDisplayName has_any ("Arista", "EOS", "eAPI")
| where ResultType == 0
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, LocationDetails;
let NetworkDeviceEvents = CommonSecurityLog
| where DeviceVendor =~ "Arista"
| where Activity has_any ("login", "authentication", "session", "config", "enable", "privilege")
| extend AuthUser = extract(@"user=(\S+)", 1, Message)
| extend SrcIP = coalesce(SourceIP, DeviceAddress)
| where isnotempty(SrcIP);
NetworkDeviceEvents
| join kind=leftouter (
    NetworkDeviceEvents
    | summarize LoginCount = count(), UniqueUsers = dcount(AuthUser) by SrcIP, bin(TimeGenerated, 1h)
    | where LoginCount > 10 or UniqueUsers > 3
) on SrcIP
| where isnotempty(LoginCount)
| union (
    CommonSecurityLog
    | where DeviceVendor =~ "Arista"
    | where Message has_any ("authentication bypass", "privilege escalation", "unauthorized", "config change", "eapi", "management api")
    | where TimeGenerated > ago(7d)
)
| project TimeGenerated, DeviceVendor, DeviceProduct, Activity, AuthUser, SrcIP, DestinationIP, Message, Computer
| order by TimeGenerated desc

index=network sourcetype IN ("arista:eos:syslog", "arista:eos:syslog:kv", "cisco:syslog", "syslog")
(vendor="Arista" OR product="EOS" OR host_type="arista")
| eval auth_user=coalesce(user, src_user, username)
| eval src_addr=coalesce(src_ip, src, sourceip)
| eval action_type=lower(coalesce(action, event_type, ""))
| search (action_type IN ("login", "authentication", "session_start", "config_change", "enable") OR message IN ("*authentication*", "*privilege*", "*eapi*", "*management api*", "*unauthorized*", "*bypass*"))
| bin _time span=10m
| stats count as event_count, dc(auth_user) as unique_users, values(action_type) as actions, values(src_addr) as source_ips, latest(message) as last_message by _time, host
| where event_count > 5 OR unique_users > 2
| eval risk_score=case(
    unique_users > 5, "critical",
    event_count > 50, "critical",
    unique_users > 2, "high",
    event_count > 10, "medium",
    true(), "low"
  )
| where risk_score IN ("critical", "high")
| table _time, host, event_count, unique_users, actions, source_ips, last_message, risk_score
| sort - _time

sequence by host.name with maxspan=5m
  [network where network.transport == "tcp" and destination.port in (22, 443, 8080, 8443)
   and (destination.ip != null)
   and (process.name in ("ssh", "curl", "python", "python3") or network.application == "ssh")]
  [any where event.dataset in ("arista.eos", "system.syslog", "network.device")
   and (
     message like~ "*arista*" or message like~ "*EOS*" or message like~ "*eapi*"
   )
   and (
     message like~ "*login*" or message like~ "*authentication*" or message like~ "*privilege*" or message like~ "*unauthorized*" or message like~ "*config*"
   )
  ]
| filter sequence_count >= 2

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  QIDNAME(qid) AS event_name,
  category,
  logsourcename(logsourceid) AS log_source,
  UTF8(payload) AS raw_payload,
  magnitude
FROM events
WHERE
  logsourcetypename(devicetype) ILIKE '%arista%'
  OR LOWER(UTF8(payload)) LIKE '%arista%'
  OR LOWER(UTF8(payload)) LIKE '%eos%'
AND (
  LOWER(UTF8(payload)) LIKE '%login%'
  OR LOWER(UTF8(payload)) LIKE '%authentication%'
  OR LOWER(UTF8(payload)) LIKE '%eapi%'
  OR LOWER(UTF8(payload)) LIKE '%privilege%'
  OR LOWER(UTF8(payload)) LIKE '%unauthorized%'
  OR LOWER(UTF8(payload)) LIKE '%config%change%'
  OR destinationport IN (22, 443, 8080, 8443)
)
AND starttime > NOW() - 7 DAYS
GROUP BY sourceip, username, destinationip
HAVING COUNT(*) > 5
ORDER BY magnitude DESC, event_time DESC
LIMIT 500

_sourceCategory=network/arista OR _sourceCategory=*eos* OR _sourceName=*arista*
| parse "*" as raw_message nodrop
| where raw_message matches "*login*" or raw_message matches "*authentication*" or raw_message matches "*eapi*" or raw_message matches "*privilege*" or raw_message matches "*unauthorized*" or raw_message matches "*management api*"
| parse regex field=raw_message "(?:user|username|User)=(?P<auth_user>\S+)" nodrop
| parse regex field=raw_message "(?:from|src|source)[= ](?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| timeslice 10m
| stats count as event_count, dcount(auth_user) as unique_users, values(src_ip) as source_ips, last(raw_message) as sample_event by _timeslice, _sourceHost
| where event_count > 5 or unique_users > 2
| sort by event_count desc

rule cve_2026_7473_arista_eos_auth_bypass {
  meta:
    author = "df00tech detection engineering"
    description = "Detects potential exploitation of CVE-2026-7473 in Arista EOS via anomalous authentication and management API access patterns"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137"

  events:
    (
      $e.metadata.product_name = /arista/i or
      $e.metadata.vendor_name = /arista/i or
      $e.target.application = /EOS/i or
      $e.network.application_protocol = "SSH"
    )
    and (
      $e.metadata.event_type = "USER_LOGIN" or
      $e.metadata.event_type = "USER_UNCATEGORIZED" or
      $e.metadata.event_type = "NETWORK_CONNECTION"
    )
    and (
      $e.target.port = 22 or
      $e.target.port = 443 or
      $e.target.port = 8080 or
      $e.target.port = 8443
    )
    and $e.principal.ip != ""

  match:
    $e.principal.ip over 10m

  outcome:
    $risk_score = max(if($e.metadata.event_type = "USER_LOGIN", 50, 25))
    $target_host = array_distinct($e.target.hostname)
    $src_ip = $e.principal.ip

  condition:
    #e > 5
}

#event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6", "ProcessRollup2", "UserLogon")
| RemotePort IN [22, 443, 8080, 8443]
| CommandLine IN ["*ssh*arista*", "*curl*eapi*", "*python*arista*", "*napalm*", "*netmiko*", "*paramiko*"]
  OR (FileName IN ["ssh", "curl", "python3", "python"] AND RemotePort IN [22, 443, 8080, 8443])
| groupBy([RemoteIP, LocalIP, UserName], function=[
    count(aid, as=connection_count),
    collect(CommandLine, as=commands),
    collect(FileName, as=processes),
    min(timestamp, as=first_seen),
    max(timestamp, as=last_seen)
  ])
| where connection_count > 3
| sort(connection_count, order=desc)
| limit 200