Cisco Secure Email Gateway SQL Injection (CVE-2026-76461)

let sqliPatterns = dynamic(["union select","' or '1'='1","'--","'; ","sleep(","waitfor delay","benchmark(","pg_sleep","information_schema","' and 1=convert","extractvalue(","updatexml(","xp_cmdshell","' union"]);
let esaHosts = dynamic([]);
CommonSecurityLog
| where DeviceVendor has "Cisco" or DeviceProduct has_any ("Email Security", "Secure Email", "ESA", "IronPort")
| where RequestURL has_any ("/api/", "/login", "/csa", "/websafety", "/ui/") or Message has "POST"
| extend LowerReq = tolower(strcat(RequestURL, " ", Message))
| where LowerReq has_any (sqliPatterns)
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod, DeviceProduct, Message
| summarize AttemptCount = count(), Patterns = make_set(RequestURL, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DeviceProduct
| where AttemptCount >= 1
| order by AttemptCount desc

index=* (sourcetype=cisco:esa OR sourcetype=cisco:email OR sourcetype=cef sourcetype=cisco:ironport OR host=*esa*) (uri_query=* OR request=* OR message=*)
| eval combined=lower(coalesce(uri_query, request, _raw))
| where match(combined, "(union\s+select|'\s+or\s+'?1'?='?1|'--|sleep\(|waitfor\s+delay|benchmark\(|pg_sleep|information_schema|extractvalue\(|updatexml\(|xp_cmdshell|'\s*union)")
| stats count as attempts values(uri_path) as targeted_paths min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip sourcetype
| where attempts >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - attempts

any where (network.protocol == "http" or event.dataset == "cisco.esa") and
  (
    stringContains(url.query, "union select") or
    stringContains(url.query, "information_schema") or
    stringContains(url.query, "' or '1'='1") or
    stringContains(url.query, "sleep(") or
    stringContains(url.query, "waitfor delay") or
    stringContains(url.query, "extractvalue(") or
    stringContains(url.query, "updatexml(") or
    stringContains(http.request.body.content, "union select") or
    stringContains(http.request.body.content, "xp_cmdshell")
  ) and
  (destination.domain like "*esa*" or url.path like "/api/*" or url.path like "/csa*" or url.path like "/login*")

SELECT sourceip, destinationip, "URL", "Request Method", QIDNAME(qid) AS event_name, COUNT(*) AS attempts, MIN(starttime) AS first_seen, MAX(starttime) AS last_seen FROM events WHERE (LOGSOURCETYPENAME(devicetype) ILIKE '%Cisco%' OR "DeviceProduct" ILIKE '%Email Security%' OR "DeviceProduct" ILIKE '%IronPort%') AND (LOWER("URL") IMATCHES '.*(union\s+select|information_schema|.--|sleep\(|waitfor\s+delay|extractvalue\(|updatexml\(|xp_cmdshell).*' OR LOWER(payload) IMATCHES '.*(union\s+select|information_schema|xp_cmdshell).*') GROUP BY sourceip, destinationip, event_name ORDER BY attempts DESC LAST 24 HOURS

_sourceCategory=*cisco*esa* OR _sourceCategory=*email*gateway*
| tolowercase(_raw) as lc
| where lc matches /(union\s+select|'\s+or\s+'?1'?='?1|information_schema|sleep\(|waitfor\s+delay|benchmark\(|extractvalue\(|updatexml\(|xp_cmdshell|'\s*union|'--)/
| parse regex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| count as attempts, min(_messagetime) as first_seen, max(_messagetime) as last_seen by src_ip, _sourceCategory
| where attempts >= 1
| sort by attempts desc

rule cisco_esa_sqli_cve_2026_76461 {
  meta:
    author = "Argus Detection Platform"
    description = "Detects SQL injection attempts against Cisco Secure Email Gateway (CVE-2026-76461)"
    severity = "HIGH"
    cve = "CVE-2026-76461"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($e.network.http.parsed_user_agent, ".*") or true
    )
    (
      re.regex($e.principal.resource.name, "(?i)(union\\s+select|information_schema|sleep\\(|waitfor\\s+delay|extractvalue\\(|updatexml\\(|xp_cmdshell|'\\s*union|'--)") or
      re.regex($e.target.url, "(?i)(union\\s+select|information_schema|sleep\\(|waitfor\\s+delay|extractvalue\\(|updatexml\\(|xp_cmdshell|'\\s*union|'--)")
    )
    $e.target.hostname = $host
  match:
    $host over 5m
  condition:
    $e
}

#event_simpleName=/Http|Dns|NetworkConnect/ OR #repo=cisco_esa
| lower(field=RequestUrl, as=lc_url)
| lower(field=RawMessage, as=lc_msg)
| case {
    lc_url=/(union\s+select|information_schema|sleep\(|waitfor\s+delay|extractvalue\(|updatexml\(|xp_cmdshell|'\s*union|'--)/ | Match := "url";
    lc_msg=/(union\s+select|information_schema|xp_cmdshell|'\s*union)/ | Match := "msg";
    * | Match := "none";
  }
| Match != "none"
| groupBy([RemoteAddressIP4, LocalAddressIP4], function=([count(as=attempts), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)]))
| sort(attempts, order=desc)