CVE-2025-54404

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "swctrl"
| where FileName in ("sh", "bash", "cmd.exe", "powershell.exe")
| where ProcessCommandLine contains "new_device_name"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, RemoteIP, RemotePort
| extend OSCommandInjection = "Possible OS Command Injection via swctrl"
| union (
    DeviceNetworkEvents
    | where RemotePort == 53413 // Default UDP port for swctrl, if known
    | where Protocol == "UDP"
    | where InitiatingProcessFileName =~ "swctrl"
    | summarize RequestCount = count() by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName
    | where RequestCount > 5 // Threshold for unusual activity, adjust as needed
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, RequestCount
    | extend UnusualUDPActivity = "Unusual UDP activity on swctrl port"
)

Splunk SPL

(index=* OR index=main) sourcetype=syslog (process=swctrl OR command="swctrl") (sh OR bash OR cmd.exe OR powershell.exe) new_device_name
| table _time, host, process, command, user, dest_ip, dest_port
| rename dest_ip as RemoteIP, dest_port as RemotePort
| eval OSCommandInjection = "Possible OS Command Injection via swctrl"
| union (
    (index=* OR index=main) sourcetype=udp_traffic dest_port=53413
    | stats count as RequestCount by host, src_ip, dest_port
    | where RequestCount > 5
    | table _time, host, src_ip, dest_port, RequestCount
    | rename src_ip as RemoteIP, dest_port as RemotePort
    | eval UnusualUDPActivity = "Unusual UDP activity on swctrl port"
)

Sigma

title: Planet WGR-500 swctrl OS Command Injection
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx # Generate a unique GUID
status: experimental
description: Detects potential OS command injection attempts targeting the Planet WGR-500 swctrl service.
references:
  - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2227
logsource:
  category: process_creation
  product: linux
detection:
  selection_process:
    ParentImage|endswith: 'swctrl'
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/sh'
      - '/usr/bin/bash'
    CommandLine|contains: 'new_device_name'
  condition: selection_process
fields:
  - CommandLine
  - Image
  - ParentImage
tags:
  - attack.execution
  - cve.2025.54404
  - cwe.78
level: high

Elastic ES|QL

from process where event.type == "start" and process.parent.executable == "swctrl" and process.executable in ("sh", "bash", "cmd.exe", "powershell.exe") and process.args contains "new_device_name"
| project @timestamp, host.name, process.parent.executable, process.executable, process.command_line
| append (
    from network where network.transport == "udp" and destination.port == 53413 and process.executable == "swctrl"
    | stats count() as request_count by host.name, source.ip, destination.port, process.executable
    | where request_count > 5
    | project @timestamp, host.name, source.ip, destination.port, request_count
)