ThreatPulse — May 14, 2026 | 6 threats, personalised for Demo User

        May 14, 2026

ThreatPulse — May 14, 2026 | 6 threats, personalised for Demo User

Threat Intelligence Digest
ThreatPulse — May 14, 2026

    Personalised for Demo User
     ·  Soc Analyst
     ·  Detection: KQL

  Threat Level: CRITICAL

6
Items

4
Critical

2
High

1
CISA KEV

HIGH

        29/100

Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access

      CVSS 7.2
       · 
      EPSS 6.4%
       · thehackernews.com

CISA KEVHIGHKQLCVE-2026-6973

MITRE ATT&CKT1190T1078

CRITICAL

        42/100

CVE-2020-37168: Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force 

      CVSS 9.8
       · 
      EPSS 0.0%
       · nvd.nist.gov

CRITICALKQLCVE-2020-37168

SummaryCVE-2020-37168 affects Ecommerce Systempay 1.0 with a weak cryptographic implementation allowing attackers to brute-force 16-character production secret keys used for payment signature generation. Successful exploitation enables attackers to forge valid payment signatures and manipulate transaction amounts, directly compromising payment integrity and financial data.
TriageSeverity: CRITICAL if Systempay 1.0 is deployed in production payment flows; HIGH if legacy/test instances exist. Immediate action required: inventory all Systempay instances and verify version. No active exploitation reported in CISA KEV, but vulnerability is trivial to exploit (CVSS 9.8, EPSS 0.0% suggests low current threat actor interest but high intrinsic risk).
Detection (KQL)
KQL
let SystempayEndpoints = dynamic(["/payment", "/systempay", "/pay", "/checkout"]);
let SuspiciousSHA1Patterns = dynamic(["sha1", "hash", "signature", "verify"]);
union
(DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (SystempayEndpoints) or InitiatingProcessFileName =~ "systempay.exe"
| where ActionType in ("ConnectionSuccess", "ConnectionAttempted")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine),
(DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any (SuspiciousSHA1Patterns) or FileName =~ "systempay.exe"
| where ProcessCommandLine matches regex @"(?i)(brute|crack|key|secret|signature)"
| project Timestamp, DeviceName, ProcessCommandLine, ProcessId, AccountName, FileName),
(CloudAppEvents
| where Timestamp > ago(7d)
| where Application =~ "Systempay" or ObjectName has "payment"
| where ActionType in ("PaymentProcessed", "TransactionModified", "SignatureVerificationFailed")
| project Timestamp, AccountUpn, Application, ActionType, ObjectName, RawEventData)
| summarize EventCount=count(), UniqueDevices=dcount(DeviceName), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by RemoteUrl, InitiatingProcessFileName, ProcessCommandLine
| where EventCount > 5 or UniqueDevices > 1
| limit 1000

SecurityEvent
| where Timestamp > ago(7d)
| where Activity has_any ("Systempay", "payment", "signature") or CommandLine matches regex @"(?i)(sha1|hash.*key|brute.*secret)"
| where EventID in (4688, 4689)
| project Timestamp, Computer, Account, CommandLine, ParentProcessName, ProcessName
| join kind=inner (
  SecurityEvent
  | where Timestamp > ago(7d)
  | where EventID == 4625
  | project TargetUserName, FailureReason, Computer
) on Computer
| limit 1000

SigninLogs
| where TimeGenerated > ago

CRITICAL

        42/100

CVE-2026-40621: ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected produc

      CVSS 9.8
       · 
      EPSS 0.0%
       · nvd.nist.gov

CRITICALKQLCVE-2026-40621

SummaryELECOM wireless LAN access point devices contain an authentication bypass vulnerability (CVE-2026-40621, CVSS 9.8) allowing unauthenticated access to specific administrative URLs. Exploitation enables attackers to reconfigure network infrastructure, intercept traffic, or pivot into corporate networks without credentials.
TriageCRITICAL — CVSS 9.8 with zero authentication requirement. Immediate action required if ELECOM APs are deployed. No active exploitation reported (EPSS 0.0%), but vulnerability is trivial to exploit. Prioritize inventory and isolation of affected devices.
Detection (KQL) — Query 1
KQL
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "elecom" or InitiatingProcessFileName has "elecom"
| summarize DeviceCount=dcount(DeviceId), URLs=make_set(RemoteUrl) by DeviceName
| where DeviceCount > 0
Detection (KQL) — Query 2
KQL
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where Protocol =~ "http" and (RemoteUrl matches regex @"(?i)(admin|config|setup|status)" or RemoteUrl has "192.168")
| where RemotePort in (80, 8080)
| summarize RequestCount=count(), UniqueIPs=make_set(RemoteIP) by DeviceName, RemoteUrl, InitiatingProcessFileName
| where RequestCount > 5
Detection (KQL) — Query 3
KQL
SecurityEvent
| where Timestamp > ago(7d)
| where EventID in (4688, 4689) and (CommandLine has "elecom" or CommandLine matches regex @"(?i)(wireless|ap|access.?point)")
| summarize EventCount=count(), Commands=make_set(CommandLine) by Computer, Account
| where EventCount > 2

---</pre></div>
<span style="font-size:11px;font-weight:700;color:#64748b;text-transform:uppercase;letter-spacing:0.8px;margin:16px 0 6px;display:block;">MITRE ATT&amp;CK</span><div style="margin:0 0 8px;"><span style="display:inline-block;padding:2px 10px;border-radius:3px;font-size:11px;font-weight:600;letter-spacing:0.3px;margin-right:6px;margin-bottom:4px;background:#f3e8ff;color:#6b21a8;">T1190</span><span style="display:inline-block;padding:2px 10px;border-radius:3px;font-size:11px;font-weight:600;letter-spacing:0.3px;margin-right:6px;margin-bottom:4px;background:#f3e8ff;color:#6b21a8;">T1021.001</span><span style="display:inline-block;padding:2px 10px;border-radius:3px;font-size:11px;font-weight:600;letter-spacing:0.3px;margin-right:6px;margin-bottom:4px;background:#f3e8ff;color:#6b21a8;">T1556</span><span style="display:inline-block;padding:2px 10px;border-radius:3px;font-size:11px;font-weight:600;letter-spacing:0.3px;margin-right:6px;margin-bottom:4px;background:#f3e8ff;color:#6b21a8;">T1040</span></div>
<span style="font-size:11px;font-weight:700;color:#64748b;text-transform:uppercase;letter-spacing:0.8px;margin:16px 0 6px;display:block;">Recommended Action</span><p style="font-size:13px;line-height:1.7;color:#334155;margin:0 0 8px;">1. Immediate: Query network for ELECOM devices (model numbers: WRC-, WRC-1167GS, WRC-2533GST, etc.) via DHCP logs and ARP tables.
2. Isolate: Segment identified ELECOM APs to management VLAN; restrict administrative access to authorized IPs only.
3. Patch: Check ELECOM security advisories for firmware updates; apply immediately or replace devices if no patch available.
4. Monitor:** Enable logging on network perimeter for HTTP requests to device admin interfaces; alert on anomalous configuration changes.</p>
  </div>
</div>

<div style="border:1px solid #e2e8f0;border-radius:8px;margin-bottom:24px;
            overflow:hidden;box-shadow:0 2px 8px rgba(15,23,42,.07);
            font-family:-apple-system,'Segoe UI',Arial,sans-serif;">
  <!-- Severity strip -->
  <div style="height:4px;background:#dc2626;"></div>
  <!-- Card header -->
  <div style="padding:14px 18px 12px;border-bottom:1px solid #e2e8f0;background:#fef2f2;">
    <!-- Severity label + score on same line -->
    <div style="margin-bottom:6px;">
      <span style="font-size:10px;font-weight:800;color:#dc2626;
                   letter-spacing:1.5px;text-transform:uppercase;">CRITICAL</span>
      <span style="float:right;font-size:13px;font-weight:800;padding:3px 10px;
                   border-radius:4px;background:#94a3b8;color:#fff;line-height:1.4;">
        42<span style="font-size:10px;font-weight:400;opacity:0.75;">/100</span>
      </span>
    </div>
    <div style="font-size:15px;font-weight:700;line-height:1.4;padding-right:80px;
                margin-bottom:5px;">
      <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42062" style="color:#0f172a;text-decoration:none;">CVE-2026-42062: ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If process</a>
    </div>
    <div style="font-size:12px;color:#64748b;">
      CVSS&nbsp;<strong style="color:#374151;">9.8</strong>
      &nbsp;&middot;&nbsp;
      EPSS&nbsp;<strong style="color:#374151;">0.0%</strong>
      &nbsp;&middot;&nbsp;nvd.nist.gov
    </div>
    <div style="margin-top:8px;line-height:2;"><span style="display:inline-block;padding:2px 10px;border-radius:3px;font-size:11px;font-weight:600;letter-spacing:0.3px;margin-right:6px;margin-bottom:4px;background:#fee2e2;color:#991b1b;">CRITICAL</span><span style="display:inline-block;padding:2px 10px;border-radius:3px;font-size:11px;font-weight:600;letter-spacing:0.3px;margin-right:6px;margin-bottom:4px;background:#f1f5f9;color:#475569;">KQL</span><span style="display:inline-block;padding:2px 10px;border-radius:3px;font-size:11px;font-weight:600;letter-spacing:0.3px;margin-right:6px;margin-bottom:4px;background:#dcfce7;color:#166534;">CVE-2026-42062</span></div>
  </div>
  <div style="padding:16px 18px 14px;">
    <span style="font-size:11px;font-weight:700;color:#64748b;text-transform:uppercase;letter-spacing:0.8px;margin:0 0 6px;display:block;">Summary</span><p style="font-size:13px;line-height:1.7;color:#334155;margin:0 0 8px;">ELECOM wireless LAN access point devices are vulnerable to unauthenticated OS command injection via crafted username parameters, allowing arbitrary code execution with CVSS 9.8 severity. This affects network infrastructure across all industries and requires immediate inventory and patching.</p>
<span style="font-size:11px;font-weight:700;color:#64748b;text-transform:uppercase;letter-spacing:0.8px;margin:16px 0 6px;display:block;">Triage</span><p style="font-size:13px;line-height:1.7;color:#334155;margin:0 0 8px;">CRITICAL – Unauthenticated remote code execution on network perimeter devices. Prioritize immediate detection of exploitation attempts and device inventory verification. No active exploitation reported (EPSS 0.0%), but attack surface is high.</p>
<span style="font-size:11px;font-weight:700;color:#64748b;text-transform:uppercase;letter-spacing:0.8px;margin:16px 0 6px;display:block;">Detection (KQL) — Query 1</span>
<div style="border-radius:6px;overflow:hidden;margin:6px 0 14px;border:1px solid #1e3a5f;"><div style="background:#1e293b;padding:6px 14px;border-radius:6px 6px 0 0;display:block;border-bottom:1px solid #0d1117;"><span style="font-size:10px;font-weight:700;color:#3b82f6;letter-spacing:1.5px;text-transform:uppercase;font-family:monospace;">KQL</span></div><pre style="background:#0d1117;color:#e2e8f0;margin:0;padding:14px 16px;font-size:12px;line-height:1.65;overflow-x:auto;white-space:pre-wrap;word-break:break-word;border-radius:0 0 6px 6px;font-family:'Cascadia Code','Fira Code','Consolas',monospace;">DeviceNetworkEvents
| where Timestamp &gt; ago(7d)
| where RemoteUrl has_any ("elecom", "192.168", "10.0", "172.16") or InitiatingProcessFileName has_any ("curl", "wget", "powershell")
| where RemoteUrl matches regex @"(?i)(username|user)=.*[;&amp;|`$()]"
| project Timestamp, DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine
| limit 1000</pre></div>
<span style="font-size:11px;font-weight:700;color:#64748b;text-transform:uppercase;letter-spacing:0.8px;margin:16px 0 6px;display:block;">Detection (KQL) — Query 2</span>
<div style="border-radius:6px;overflow:hidden;margin:6px 0 14px;border:1px solid #1e3a5f;"><div style="background:#1e293b;padding:6px 14px;border-radius:6px 6px 0 0;display:block;border-bottom:1px solid #0d1117;"><span style="font-size:10px;font-weight:700;color:#3b82f6;letter-spacing:1.5px;text-transform:uppercase;font-family:monospace;">KQL</span></div><pre style="background:#0d1117;color:#e2e8f0;margin:0;padding:14px 16px;font-size:12px;line-height:1.65;overflow-x:auto;white-space:pre-wrap;word-break:break-word;border-radius:0 0 6px 6px;font-family:'Cascadia Code','Fira Code','Consolas',monospace;">DeviceProcessEvents
| where Timestamp &gt; ago(7d)
| where ProcessCommandLine matches regex @"(?i)(sh|bash|cmd|powershell).*(-c|-Command|/c)" and (ProcessCommandLine contains ";" or ProcessCommandLine contains "|" or ProcessCommandLine contains "&amp;")
| where DeviceName matches regex @"(elecom|ap|router|gateway)" or FolderPath has_any ("/etc/", "C:\\Windows\\System32\\")
| project Timestamp, DeviceName, ProcessCommandLine, AccountName, ProcessId, ParentProcessFileName
| limit 1000</pre></div>
<span style="font-size:11px;font-weight:700;color:#64748b;text-transform:uppercase;letter-spacing:0.8px;margin:16px 0 6px;display:block;">Detection (KQL) — Query 3</span>
<div style="border-radius:6px;overflow:hidden;margin:6px 0 14px;border:1px solid #1e3a5f;"><div style="background:#1e293b;padding:6px 14px;border-radius:6px 6px 0 0;display:block;border-bottom:1px solid #0d1117;"><span style="font-size:10px;font-weight:700;color:#3b82f6;letter-spacing:1.5px;text-transform:uppercase;font-family:monospace;">KQL</span></div><pre style="background:#0d1117;color:#e2e8f0;margin:0;padding:14px 16px;font-size:12px;line-height:1.65;overflow-x:auto;white-space:pre-wrap;word-break:break-word;border-radius:0 0 6px 6px;font-family:'Cascadia Code','Fira Code','Consolas',monospace;">SecurityEvent
| where Timestamp &gt; ago(7d)
| where Activity has_any ("Logon", "Network Share Object Accessed", "Special Privileges Assigned")
| where TargetUserName matches regex @"(?i).*[;&amp;|`$(){}].*" or Account matches regex @"(?i).*username.*[;&amp;|`$(){}]"
| where Computer matches regex @"(elecom|ap|router|gateway|wireless)" or SourceIP in ("0.0.0.0", "255.255.255.255")
| project Timestamp, Computer, Account, Activity, SourceIP, TargetUserName
| limit 1000</pre></div>
<span style="font-size:11px;font-weight:700;color:#64748b;text-transform:uppercase;letter-spacing:0.8px;margin:16px 0 6px;display:block;">MITRE ATT&amp;CK</span><div style="margin:0 0 8px;"><span style="display:inline-block;padding:2px 10px;border-radius:3px;font-size:11px;font-weight:600;letter-spacing:0.3px;margin-right:6px;margin-bottom:4px;background:#f3e8ff;color:#6b21a8;">T1190</span><span style="display:inline-block;padding:2px 10px;border-radius:3px;font-size:11px;font-weight:600;letter-spacing:0.3px;margin-right:6px;margin-bottom:4px;background:#f3e8ff;color:#6b21a8;">T1059</span><span style="display:inline-block;padding:2px 10px;border-radius:3px;font-size:11px;font-weight:600;letter-spacing:0.3px;margin-right:6px;margin-bottom:4px;background:#f3e8ff;color:#6b21a8;">T1021</span></div>
<span style="font-size:11px;font-weight:700;color:#64748b;text-transform:uppercase;letter-spacing:0.8px;margin:16px 0 6px;display:block;">Recommended Action</span><p style="font-size:13px;line-height:1.7;color:#334155;margin:0 0 8px;">1. Immediate: Query network inventory for all ELECOM wireless LAN access points; cross-reference with device management systems.
2. Within 24h: Apply vendor security patches (check ELECOM advisory for firmware versions); if unavailable, isolate affected devices to management VLAN only.
3. Ongoing: Monitor DeviceNetworkEvents and DeviceProcessEvents for command injection patterns; alert on any matches with severity Critical.</p>
  </div>
</div>

<div style="border:1px solid #e2e8f0;border-radius:8px;margin-bottom:24px;
            overflow:hidden;box-shadow:0 2px 8px rgba(15,23,42,.07);
            font-family:-apple-system,'Segoe UI',Arial,sans-serif;">
  <!-- Severity strip -->
  <div style="height:4px;background:#dc2626;"></div>
  <!-- Card header -->
  <div style="padding:14px 18px 12px;border-bottom:1px solid #e2e8f0;background:#fef2f2;">
    <!-- Severity label + score on same line -->
    <div style="margin-bottom:6px;">
      <span style="font-size:10px;font-weight:800;color:#dc2626;
                   letter-spacing:1.5px;text-transform:uppercase;">CRITICAL</span>
      <span style="float:right;font-size:13px;font-weight:800;padding:3px 10px;
                   border-radius:4px;background:#94a3b8;color:#fff;line-height:1.4;">
        35<span style="font-size:10px;font-weight:400;opacity:0.75;">/100</span>
      </span>
    </div>
    <div style="font-size:15px;font-weight:700;line-height:1.4;padding-right:80px;
                margin-bottom:5px;">
      <a href="https://thehackernews.com/2026/05/new-exim-bdat-vulnerability-exposes.html" style="color:#0f172a;text-decoration:none;">New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution</a>
    </div>
    <div style="font-size:12px;color:#64748b;">
      CVSS&nbsp;<strong style="color:#374151;">9.8</strong>
      &nbsp;&middot;&nbsp;
      EPSS&nbsp;<strong style="color:#374151;">0.1%</strong>
      &nbsp;&middot;&nbsp;thehackernews.com
    </div>
    <div style="margin-top:8px;line-height:2;"><span style="display:inline-block;padding:2px 10px;border-radius:3px;font-size:11px;font-weight:600;letter-spacing:0.3px;margin-right:6px;margin-bottom:4px;background:#fee2e2;color:#991b1b;">CRITICAL</span><span style="display:inline-block;padding:2px 10px;border-radius:3px;font-size:11px;font-weight:600;letter-spacing:0.3px;margin-right:6px;margin-bottom:4px;background:#f1f5f9;color:#475569;">KQL</span><span style="display:inline-block;padding:2px 10px;border-radius:3px;font-size:11px;font-weight:600;letter-spacing:0.3px;margin-right:6px;margin-bottom:4px;background:#dcfce7;color:#166534;">CVE-2026-45185</span></div>
  </div>
  <div style="padding:16px 18px 14px;">
    <span style="font-size:11px;font-weight:700;color:#64748b;text-transform:uppercase;letter-spacing:0.8px;margin:0 0 6px;display:block;">Summary</span><p style="font-size:13px;line-height:1.7;color:#334155;margin:0 0 8px;">A critical vulnerability (CVSS 9.8) in Exim Mail Transfer Agent allows memory corruption and potential remote code execution via malformed BDAT commands in GnuTLS-enabled builds. Organizations running Exim as their primary MTA face immediate risk of email infrastructure compromise and lateral movement into internal networks.</p>
<span style="font-size:11px;font-weight:700;color:#64748b;text-transform:uppercase;letter-spacing:0.8px;margin:16px 0 6px;display:block;">Triage</span><p style="font-size:13px;line-height:1.7;color:#334155;margin:0 0 8px;">CRITICAL — Immediate investigation required. CVSS 9.8 with unauthenticated attack vector. Prioritize: (1) Identify all Exim instances in production, (2) Check GnuTLS compilation status, (3) Hunt for exploitation attempts in mail logs and process execution.</p>
<span style="font-size:11px;font-weight:700;color:#64748b;text-transform:uppercase;letter-spacing:0.8px;margin:16px 0 6px;display:block;">Detection (KQL)</span>
<div style="border-radius:6px;overflow:hidden;margin:6px 0 14px;border:1px solid #1e3a5f;"><div style="background:#1e293b;padding:6px 14px;border-radius:6px 6px 0 0;display:block;border-bottom:1px solid #0d1117;"><span style="font-size:10px;font-weight:700;color:#3b82f6;letter-spacing:1.5px;text-transform:uppercase;font-family:monospace;">KQL</span></div><pre style="background:#0d1117;color:#e2e8f0;margin:0;padding:14px 16px;font-size:12px;line-height:1.65;overflow-x:auto;white-space:pre-wrap;word-break:break-word;border-radius:0 0 6px 6px;font-family:'Cascadia Code','Fira Code','Consolas',monospace;">let TimeWindow = 7d;
let EximProcesses = dynamic(["exim", "exim4"]);
let SuspiciousCommands = dynamic(["BDAT", "bdat"]);
union
(DeviceProcessEvents
| where Timestamp &gt; ago(TimeWindow)
| where ProcessCommandLine has_any (EximProcesses)
| where ProcessCommandLine matches regex @"(?i)(BDAT|bdat|memory|corruption|crash)"
| project Timestamp, DeviceName, ProcessCommandLine, ProcessId, AccountName, FileName),
(DeviceNetworkEvents
| where Timestamp &gt; ago(TimeWindow)
| where InitiatingProcessFileName has_any (EximProcesses)
| where RemotePort in (25, 587, 465)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine),
(SecurityEvent
| where Timestamp &gt; ago(TimeWindow)
| where Process has_any (EximProcesses)
| where EventID in (1, 3, 5145)
| project Timestamp, Computer, Process, CommandLine, Account, EventID)
| order by Timestamp desc
| limit 1000

DeviceProcessEvents
| where Timestamp &gt; ago(7d)
| where FileName =~ "exim" or FileName =~ "exim4"
| where ProcessCommandLine contains "-d" or ProcessCommandLine contains "--debug"
| where ProcessIntegrityLevel =~ "System" or ProcessTokenElevation =~ "TokenElevationTypeFull"
| summarize EventCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), UniqueUsers = dcount(AccountName) by DeviceName, FileName, ProcessCommandLine
| where EventCount &gt; 5
| project DeviceName, FileName, ProcessCommandLine, EventCount, FirstSeen, LastSeen, UniqueUsers

```
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has_any ("exim", "exim4")
| where RemotePort in (25, 587, 465, 110, 143)
| where ActionType =~ "ConnectionSuccess" or ActionType =~ "ConnectionAttempt"
| summarize ConnectionCount = count(), RemoteIPs = make_set(RemoteIP), Ports = make_set(RemotePort) by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
| where ConnectionCount > 20
| project Timestamp, DeviceName

HIGH

        31/100

18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE

      CVSS 8.1
       · 
      EPSS 0.0%
       · thehackernews.com

HIGHKQLCVE-2026-42945

SummaryAn 18-year-old heap buffer overflow in NGINX's rewrite module (CVE-2026-42945) enables unauthenticated remote code execution with CVSS 9.2 severity. Any internet-facing NGINX instance running vulnerable versions is immediately exploitable without authentication or user interaction.
TriageCRITICAL — Immediate investigation required. This is an unauthenticated RCE with 18 years of exposure in production deployments. Prioritize: (1) inventory all NGINX instances, (2) check for exploitation attempts in logs, (3) patch or disable rewrite module immediately.
Detection (KQL) — Query 1
KQL
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("nginx", "ngx_http_rewrite_module") or FileName =~ "nginx.exe"
| where ProcessCommandLine contains_any ("rewrite", "-c", "conf")
| project Timestamp, DeviceName, ProcessCommandLine, AccountName, ProcessId, SHA1
| limit 1000
Detection (KQL) — Query 2
KQL
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "nginx.exe" or InitiatingProcessFileName =~ "nginx"
| where ActionType in ("ConnectionSuccess", "ConnectionAttempted")
| where RemoteIPType == "Public" and LocalIPType == "Private"
| where RemotePort !in (80, 443)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessCommandLine
| limit 1000
Detection (KQL) — Query 3
KQL
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ParentProcessFileName =~ "nginx.exe" or ParentProcessFileName =~ "nginx"
| where FileName !in ("nginx.exe", "nginx", "cmd.exe", "powershell.exe")
| project Timestamp, DeviceName, ParentProcessFileName, FileName, ProcessCommandLine, AccountName, ProcessId
| limit 1000
MITRE ATT&CKT1190T1059T1046
Recommended Action1. Immediate: Run inventory query to identify all NGINX instances: DeviceProcessEvents | where FileName =~ "nginx" | summarize by DeviceName, ProcessCommandLine | limit 1000
2. Within 1 hour: Patch NGINX to patched version or disable ngx_http_rewrite_module in nginx.conf
3. Within 4 hours: Review web server access logs (80/443) for suspicious rewrite directives or encoded payloads in request URIs from past 30 days
4. Ongoing: Monitor for process spawning from nginx parent process and unexpected outbound connections on non-standard

THREATPULSE
Automated threat intelligence, personalised for your role.

Unsubscribe
     · 
    Update Preferences
     · 
    threatpulse.io

                                Don't miss what's next. Subscribe to Ethan Andrews:

            Email address (required)