OpenC3 COSMOS Authenticated RCE via User-Writable Config Overlay (CVE-2026-77602)

// COSMOS config-overlay RCE: service container spawning shells/interpreters
let cosmosImages = dynamic(["openc3-cosmos-cmd-tlm-api","openc3-cosmos-script-runner-api","openc3-operator","openc3-cosmos-init"]);
let shells = dynamic(["sh","bash","dash","zsh","nc","ncat","curl","wget","python","python3","perl","ruby","socat"]);
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("ruby","rails","puma","rackup","bundle")
    or InitiatingProcessCommandLine has_any ("cmd-tlm-api","script-runner-api","openc3")
| where FileName in~ (shells)
| where ProcessCommandLine has_any ("-c","-e","/dev/tcp","base64","bash -i","curl","wget")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessId
| order by Timestamp desc

index=linux (sourcetype="linux:audit" OR sourcetype="sysmon_linux" OR sourcetype="docker:events")
(parent_process_name IN ("ruby","puma","rails","rackup","bundle") OR parent_process="*cmd-tlm-api*" OR parent_process="*script-runner-api*")
process_name IN ("sh","bash","dash","nc","ncat","curl","wget","python","python3","perl","socat")
(process="*-c *" OR process="*/dev/tcp*" OR process="*base64*" OR process="*bash -i*")
| stats count min(_time) as firstTime max(_time) as lastTime values(process) as cmdlines by host, user, parent_process_name, process_name
| convert ctime(firstTime) ctime(lastTime)
| where count > 0

process where event.type == "start" and
  process.parent.name in ("ruby","puma","rails","rackup","bundle") and
  process.name in ("sh","bash","dash","zsh","nc","ncat","curl","wget","python","python3","perl","socat") and
  (process.args : "-c" or process.args : "-e" or process.command_line : "*/dev/tcp*" or process.command_line : "*base64*" or process.command_line : "*bash -i*")

SELECT QIDNAME(qid) AS event, "parentProcessName", "processName", "Process CommandLine" AS cmdline, username, sourceip, devicetime
FROM events
WHERE LOWER("parentProcessName") IN ('ruby','puma','rails','rackup','bundle')
AND LOWER("processName") IN ('sh','bash','dash','nc','ncat','curl','wget','python','python3','perl','socat')
AND ("Process CommandLine" ILIKE '%-c %' OR "Process CommandLine" ILIKE '%/dev/tcp%' OR "Process CommandLine" ILIKE '%base64%' OR "Process CommandLine" ILIKE '%bash -i%')
LAST 24 HOURS

_sourceCategory=*linux* ("cmd-tlm-api" OR "script-runner-api" OR "ruby" OR "puma")
| parse "ppid=* " as parent_process nodrop
| parse "comm=\"*\"" as process_name nodrop
| parse "cmdline=\"*\"" as cmdline nodrop
| where (parent_process matches /ruby|puma|rails|rackup|bundle/)
| where (process_name matches /sh|bash|dash|nc|ncat|curl|wget|python|python3|perl|socat/)
| where (cmdline matches /.*(-c |\/dev\/tcp|base64|bash -i).*/)
| count by _sourceHost, process_name, cmdline

rule cosmos_config_overlay_rce {
  meta:
    author = "Argus"
    description = "COSMOS config-overlay Ruby RCE - service process spawning shell/interpreter"
    cve = "CVE-2026-77602"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.parent_process.file.full_path = /(ruby|puma|rails|rackup|bundle)$/ nocase
    $e.target.process.file.full_path = /\/(sh|bash|dash|nc|ncat|curl|wget|python3?|perl|socat)$/ nocase
    $e.target.process.command_line = /(-c |\/dev\/tcp|base64|bash -i)/ nocase
    $e.principal.hostname = $host
  match:
    $host over 5m
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(ruby|puma|rails|rackup|bundle)$/i
| FileName=/^(sh|bash|dash|nc|ncat|curl|wget|python3?|perl|socat)$/i
| CommandLine=/(-c |\/dev\/tcp|base64|bash -i)/i
| groupBy([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], function=count())