Acronis Backup Incorrect Default Permissions Exploitation (CVE-2026-87886)

// Acronis Backup incorrect default permissions abuse - CVE-2026-87886
let acronisPaths = dynamic(["acronis", "BackupAndRecovery", "cpanel\\backup", "Acronis Agent", "mms"]);
DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has_any (acronisPaths)
| where ActionType in ("FileModified", "FileCreated", "FileRenamed")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".sh" or FileName endswith ".conf" or FileName endswith ".config" or FileName endswith ".tib" or FileName endswith ".tibx"
| where InitiatingProcessAccountName !in~ ("system", "acronis agent user", "acronismms")
| where InitiatingProcessTokenElevation != "TokenElevationTypeFull" or FileName has_any (".tib", ".tibx")
| project Timestamp, DeviceName, FolderPath, FileName, ActionType, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessTokenElevation
| order by Timestamp desc

index=* (sourcetype="WinEventLog:Security" OR sourcetype="linux:audit" OR sourcetype="Unix:FileMonitor")
(object_path="*acronis*" OR object_path="*BackupAndRecovery*" OR object_path="*cpanel*backup*" OR file_path="*acronis*")
(file_name="*.tib" OR file_name="*.tibx" OR file_name="*.exe" OR file_name="*.dll" OR file_name="*.sh" OR file_name="*.conf")
NOT (user="SYSTEM" OR user="acronis*" OR user="root")
| stats count min(_time) as firstTime max(_time) as lastTime values(action) as actions values(file_name) as files by host, user, object_path
| where count > 0
| convert ctime(firstTime) ctime(lastTime)
| sort - lastTime

file where event.type in ("change", "creation") and
  (file.path : ("*acronis*", "*BackupAndRecovery*", "*cpanel*backup*", "*Acronis Agent*")) and
  (file.extension in ("exe", "dll", "sh", "conf", "config", "tib", "tibx")) and
  not user.name in ("SYSTEM", "root", "acronis_agent_user") and
  not process.name in ("schedul2.exe", "mms.exe", "acronis_agent")

SELECT QIDNAME(qid) AS event, sourceip, username, "Filename" AS filename, "File Path" AS filepath, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS time
FROM events
WHERE ("File Path" ILIKE '%acronis%' OR "File Path" ILIKE '%BackupAndRecovery%' OR "File Path" ILIKE '%cpanel%backup%')
AND ("Filename" ILIKE '%.tib' OR "Filename" ILIKE '%.tibx' OR "Filename" ILIKE '%.exe' OR "Filename" ILIKE '%.dll' OR "Filename" ILIKE '%.sh' OR "Filename" ILIKE '%.conf')
AND username NOT IN ('SYSTEM','root')
AND username NOT ILIKE 'acronis%'
ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*os* OR _sourceCategory=*audit*
| where (%"file_path" matches "*acronis*" OR %"file_path" matches "*BackupAndRecovery*" OR %"file_path" matches "*cpanel*backup*")
| where (%"file_name" matches "*.tib" OR %"file_name" matches "*.tibx" OR %"file_name" matches "*.exe" OR %"file_name" matches "*.dll" OR %"file_name" matches "*.sh" OR %"file_name" matches "*.conf")
| where !(%"user" matches "SYSTEM") AND !(%"user" matches "root") AND !(%"user" matches "acronis*")
| count by host, user, file_path, file_name, action
| sort by _count desc

rule acronis_backup_default_perms_cve_2026_87886 {
  meta:
    author = "Argus"
    description = "Non-privileged access/modification of Acronis Backup files - CVE-2026-87886"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "FILE_MODIFICATION" or $e.metadata.event_type = "FILE_OPEN"
    re.regex($e.target.file.full_path, `(?i)(acronis|BackupAndRecovery|cpanel.*backup)`)
    re.regex($e.target.file.full_path, `(?i)\.(tib|tibx|exe|dll|sh|conf|config)$`)
    not $e.principal.user.userid = /(?i)^(SYSTEM|root|acronis).*/
  condition:
    $e
}

#event_simpleName=/^(File(Written|OpenInfo)|NewExecutableWritten)$/
| TargetFileName=/(?i)(acronis|BackupAndRecovery|cpanel.*backup)/
| TargetFileName=/(?i)\.(tib|tibx|exe|dll|sh|conf|config)$/
| UserName!=/(?i)^(SYSTEM|root|acronis)/
| groupBy([ComputerName, UserName, TargetFileName], function=count())
| sort(_count, order=desc)