N-able N-central Pre-Authentication Static Code Injection RCE (CVE-2026-86218)

let ncentralHosts = dynamic([]);
union isfuzzy=true
(
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("java.exe","java","httpd","httpd.exe","apache2","nginx","tomcat9.exe","catalina.sh","w3wp.exe")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","dash","python","python3","perl","nc","ncat","curl","wget","whoami","id")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
),
(
DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("java.exe","java","httpd","apache2","tomcat9.exe")
| where RemotePort in (4444,1337,9001,53,80,443) and ActionType == "ConnectionSuccess"
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
)
| sort by Timestamp desc

index=* (sourcetype="linux:audit" OR sourcetype="WinEventLog:Security" OR sourcetype="Sysmon" OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval parent=lower(coalesce(parent_process_name,ParentImage,pproc))
| eval child=lower(coalesce(process_name,Image,proc))
| where (like(parent,"%java%") OR like(parent,"%httpd%") OR like(parent,"%apache2%") OR like(parent,"%tomcat%") OR like(parent,"%catalina%"))
| where (like(child,"%sh") OR like(child,"%bash%") OR like(child,"%cmd.exe%") OR like(child,"%powershell%") OR like(child,"%python%") OR like(child,"%perl%") OR like(child,"%curl%") OR like(child,"%wget%") OR like(child,"%whoami%"))
| stats count min(_time) as firstTime max(_time) as lastTime values(child) as children values(process) as cmdlines by host parent user
| convert ctime(firstTime) ctime(lastTime)
| sort - count

process where event.type == "start" and
  process.parent.name in ("java","java.exe","httpd","apache2","tomcat9.exe","catalina.sh","w3wp.exe") and
  process.name in ("sh","bash","dash","cmd.exe","powershell.exe","pwsh.exe","python","python3","perl","nc","ncat","curl","wget","whoami","id")

SELECT QIDNAME(qid) AS event, sourceip, destinationip, username, "Process Name" AS process, "Parent Process Name" AS parent, "Command Line" AS cmd, starttime
FROM events
WHERE (LOWER("Parent Process Name") ILIKE '%java%' OR LOWER("Parent Process Name") ILIKE '%httpd%' OR LOWER("Parent Process Name") ILIKE '%apache2%' OR LOWER("Parent Process Name") ILIKE '%tomcat%')
AND (LOWER("Process Name") ILIKE '%sh' OR LOWER("Process Name") ILIKE '%bash%' OR LOWER("Process Name") ILIKE '%cmd.exe%' OR LOWER("Process Name") ILIKE '%powershell%' OR LOWER("Process Name") ILIKE '%python%' OR LOWER("Process Name") ILIKE '%curl%' OR LOWER("Process Name") ILIKE '%wget%')
ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*ncentral* OR _sourceCategory=*endpoint*
| json auto nodrop
| where (tolowercase(parent_process_name) matches "*java*" or tolowercase(parent_process_name) matches "*httpd*" or tolowercase(parent_process_name) matches "*apache2*" or tolowercase(parent_process_name) matches "*tomcat*")
| where (tolowercase(process_name) matches "*sh" or tolowercase(process_name) matches "*bash*" or tolowercase(process_name) matches "*cmd.exe*" or tolowercase(process_name) matches "*powershell*" or tolowercase(process_name) matches "*python*" or tolowercase(process_name) matches "*curl*" or tolowercase(process_name) matches "*wget*")
| count by host, parent_process_name, process_name, user
| sort by _count

rule ncentral_cve_2026_86218_rce {
  meta:
    author = "argus"
    description = "N-central web/app-tier process spawns shell or interpreter (CVE-2026-86218)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)(java|httpd|apache2|tomcat|catalina)`)
    re.regex($e.target.process.file.full_path, `(?i)(/(ba)?sh$|cmd\.exe|powershell|python|perl|nc$|ncat|curl|wget|whoami)`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(java|java\.exe|httpd|apache2|tomcat9\.exe|catalina\.sh|w3wp\.exe)$/i
| ImageFileName=/(\/|\\)(sh|bash|dash|cmd\.exe|powershell\.exe|pwsh\.exe|python3?|perl|nc|ncat|curl|wget|whoami|id)$/i
| groupBy([aid, ComputerName, ParentBaseFileName, FileName, CommandLine], function=count())
| sort(count, order=desc)