CVE-2026-10135

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "boa" // Assuming 'boa' is the web server binary
| where FileName in ("sh", "bash", "cmd.exe", "powershell.exe") // Common shells
| where ProcessCommandLine contains "/tmp/bzupload" or ProcessCommandLine contains "batchUpg" // Specific to the vulnerability context
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessCommandLine
| extend OSCommandInjection = "Possible OS Command Injection via batchupg functionality"

Splunk SPL

sourcetype=linux_audit OR sourcetype=windows_security
| (process="boa" OR parent_process="boa")
| (process_name IN ("sh", "bash", "cmd.exe", "powershell.exe") OR command_line IN ("* /tmp/bzupload *", "* batchUpg *"))
| table _time, host, process, parent_process, command_line, user
| eval OSCommandInjection = "Possible OS Command Injection via batchupg functionality"

Sigma

title: Totolink X2000R batchupg OS Command Injection
id: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
status: experimental
description: Detects potential OS command injection attempts via the batchupg functionality in Totolink X2000R routers.
references:
  - https://talosintelligence.com/vulnerability_reports/TALOS-2026-2435
author: SecBoard
date: 2026/10/21
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '\boa'
    Image|endswith:
      - '\sh'
      - '\bash'
    CommandLine|contains:
      - '/tmp/bzupload'
      - 'batchUpg'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
tags:
  - attack.execution
  - cve.2026.10135
  - cwe.78

Elastic ES|QL

from process where
  process.parent.name == "boa" and
  process.name in ("sh", "bash", "cmd.exe", "powershell.exe") and
  (process.args contains "/tmp/bzupload" or process.args contains "batchUpg")
|
  set @OSCommandInjection = "Possible OS Command Injection via batchupg functionality"
|
  keep @timestamp, host.name, process.parent.name, process.name, process.command_line, @OSCommandInjection