SonicWall SMA1000 OS Command Injection (CVE-2026-83549)

let injectionMarkers = dynamic([";","|","&&","`","$(","%3B","%7C","%60","nc ","curl ","wget ","/bin/sh","/bin/bash"]);
CommonSecurityLog
| where DeviceVendor =~ "SonicWall" and DeviceProduct has "SMA"
| where RequestURL has_any (injectionMarkers) or AdditionalExtensions has_any (injectionMarkers)
| where RequestMethod in~ ("POST","GET")
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod, DeviceProduct, AdditionalExtensions
| order by TimeGenerated desc

index=network (vendor="SonicWall" OR sourcetype="sonicwall:sma") sourcetype IN ("sonicwall:sma","sonicwall:sma:web")
| eval payload=coalesce(url,uri,request)
| regex payload="(;|\||&&|`|\$\(|%3B|%7C|%60|/bin/(sh|bash)|\b(nc|curl|wget)\b)"
| stats count min(_time) as firstTime max(_time) as lastTime values(payload) as payloads by src_ip dest_ip http_method
| convert ctime(firstTime) ctime(lastTime)
| sort - count

sequence by host.id with maxspan=1m
  [ network where event.category == "network" and destination.port in (443,8443) and network.direction == "inbound" ]
  [ process where event.type == "start" and process.parent.name in ("httpd","nginx","lighttpd","java","cgi-bin") and process.name in ("sh","bash","nc","curl","wget","python","perl") ]

SELECT sourceip, destinationip, "URL", "Request Method", QIDNAME(qid) AS event_name FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%SonicWall%' AND ("URL" IMATCHES '.*(;|\||&&|`|\$\(|%3B|%7C|%60|/bin/(sh|bash)|nc |curl |wget ).*') LAST 24 HOURS

_sourceCategory=*sonicwall*sma* 
| where (_raw matches /(;|\||&&|`|\$\(|%3B|%7C|%60|\/bin\/(sh|bash)|nc |curl |wget )/)
| parse "src=* " as src_ip nodrop
| parse "dst=* " as dst_ip nodrop
| count by src_ip, dst_ip
| sort by _count

rule sonicwall_sma1000_cmd_injection_CVE_2026_83549 {
  meta:
    author = "Argus"
    description = "SonicWall SMA1000 OS command injection CVE-2026-83549"
    severity = "CRITICAL"
  events:
    $e.metadata.vendor_name = "SonicWall"
    $e.principal.ip = $ip
    re.regex($e.network.http.request_url, `(;|\||&&|` + "`" + `|\$\(|%3B|%7C|%60|/bin/(sh|bash)|nc |curl |wget )`)
  condition:
    $e
}

#event_simpleName=/ProcessRollup2/ | in(field="ParentBaseFileName", values=["httpd","nginx","lighttpd","java"]) | in(field="FileName", values=["sh","bash","nc","curl","wget","python","perl"]) | groupBy([ComputerName, ParentBaseFileName, FileName, CommandLine], limit=200)