CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Exploitation

let CheckPointHosts = dynamic(["cpmgmt", "checkpoint", "smartcenter", "cp-gw", "gaia"]);
let WindowStart = ago(24h);
CommonSecurityLog
| where TimeGenerated >= WindowStart
| where DeviceVendor =~ "Check Point"
| where Activity has_any ("certificate", "TLS", "SSL", "handshake") or AdditionalExtensions has_any ("cert_validation_failed", "untrusted_ca", "cn_mismatch", "self_signed")
| extend SrcIp = SourceIP, DstIp = DestinationIP, CertSubject = tostring(parse_json(AdditionalExtensions).CertificateSubject)
| where AdditionalExtensions has_any ("self_signed", "untrusted_ca", "cn_mismatch", "cert_validation_failed", "chain_incomplete")
| project TimeGenerated, DeviceVendor, DeviceProduct, SrcIp, DstIp, DestinationPort, Activity, CertSubject, AdditionalExtensions
| join kind=leftouter (
    CommonSecurityLog
    | where TimeGenerated >= WindowStart
    | where DeviceVendor =~ "Check Point"
    | where Activity has_any ("Login", "Authentication", "VPN", "administrator")
    | project AuthTime = TimeGenerated, SrcIp = SourceIP, DstIp = DestinationIP, AuthActivity = Activity, DestinationUserName
) on SrcIp, DstIp
| where isempty(AuthTime) or (AuthTime between (TimeGenerated .. (TimeGenerated + 10m)))
| summarize CertEvents = count(), AuthFollowups = countif(isnotempty(AuthTime)), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SrcIp, DstIp, DestinationPort, DeviceProduct
| where CertEvents > 0

index=network sourcetype IN ("checkpoint:firewall", "cp_log", "opsec") (event has="certificate" OR message="*TLS*" OR message="*handshake*") (message="*self_signed*" OR message="*untrusted_ca*" OR message="*cn_mismatch*" OR message="*cert_validation_failed*" OR message="*chain_incomplete*")
| eval cert_anomaly=1
| stats min(_time) as firstTime max(_time) as lastTime count as cert_events values(cert_subject) as cert_subjects by src_ip dst_ip dest_port product
| join type=left src_ip dst_ip [
    search index=network sourcetype IN ("checkpoint:firewall", "cp_log", "opsec") (message="*Login*" OR message="*Authentication*" OR message="*VPN*" OR message="*administrator*")
    | stats count as auth_events values(user) as auth_users by src_ip dst_ip
]
| where cert_events > 0
| eval risk=if(auth_events>0,"high","medium")
| table firstTime lastTime src_ip dst_ip dest_port product cert_events cert_subjects auth_events auth_users risk
| convert ctime(firstTime) ctime(lastTime)

sequence by source.ip with maxspan=10m
  [network where event.dataset == "checkpoint.firewall" and
     (tls.server.x509.issuer.common_name != null and network.protocol == "tls") and
     (checkpoint.cert_validation == "failed" or tls.detailed.client_certificate_requested == true or
      message : ("*self_signed*", "*untrusted_ca*", "*cn_mismatch*", "*chain_incomplete*"))]
  [authentication where event.dataset == "checkpoint.firewall" and
     (event.action : ("admin-login", "vpn-login", "authentication")) and event.outcome == "success"]

SELECT sourceip, destinationip, destinationport, "Cert Anomaly Type" AS cert_anomaly, username, COUNT(*) AS event_count, MIN(startTime) AS first_seen, MAX(startTime) AS last_seen FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Check Point%' AND (QIDNAME(qid) ILIKE '%certificate%' OR QIDNAME(qid) ILIKE '%TLS%' OR QIDNAME(qid) ILIKE '%handshake%') AND (payload ILIKE '%self_signed%' OR payload ILIKE '%untrusted_ca%' OR payload ILIKE '%cn_mismatch%' OR payload ILIKE '%cert_validation_failed%' OR payload ILIKE '%chain_incomplete%') GROUP BY sourceip, destinationip, destinationport, cert_anomaly, username ORDER BY event_count DESC LAST 24 HOURS

_sourceCategory=*checkpoint* ("certificate" OR "TLS" OR "handshake") ("self_signed" OR "untrusted_ca" OR "cn_mismatch" OR "cert_validation_failed" OR "chain_incomplete")
| parse "src=*;" as src_ip nodrop
| parse "dst=*;" as dst_ip nodrop
| parse "cn=*;" as cert_cn nodrop
| parse "action=*;" as action nodrop
| where !isBlank(src_ip)
| count as cert_events, min(_messageTime) as first_seen, max(_messageTime) as last_seen by src_ip, dst_ip, cert_cn
| where cert_events > 0
| sort by cert_events desc

rule checkpoint_cve_2026_85102_cert_validation {
  meta:
    author = "Argus Detection Platform"
    description = "Detects improper certificate validation exploitation on Check Point products (CVE-2026-85102)"
    cve = "CVE-2026-85102"
    severity = "HIGH"
  events:
    $cert.metadata.vendor_name = "Check Point"
    $cert.metadata.product_event_type = /certificate|TLS|handshake/
    $cert.security_result.description = /self_signed|untrusted_ca|cn_mismatch|cert_validation_failed|chain_incomplete/
    $cert.principal.ip = $src
    $auth.metadata.vendor_name = "Check Point"
    $auth.metadata.event_type = "USER_LOGIN"
    $auth.security_result.action = "ALLOW"
    $auth.principal.ip = $src
    $cert.metadata.event_timestamp.seconds <= $auth.metadata.event_timestamp.seconds
  match:
    $src over 10m
  condition:
    $cert and $auth
}

#event_simpleName=/NetworkConnect|ExternalApiCall/ OR #repo=checkpoint
| Vendor="Check Point"
| (RawEvent=/self_signed/i OR RawEvent=/untrusted_ca/i OR RawEvent=/cn_mismatch/i OR RawEvent=/cert_validation_failed/i OR RawEvent=/chain_incomplete/i)
| case { RawEvent=/administrator|VPN|Login/i | AuthFollowup:="true"; * | AuthFollowup:="false"; }
| groupBy([SourceIp, DestinationIp, DestinationPort], function=[count(as=cert_events), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen), collect([AuthFollowup])])
| cert_events > 0
| sort(cert_events, order=desc)