CVE-2026-114625

Sentinel/Defender KQL

// Monitor for connections from known malicious IP addresses
NetworkConnectionEvents
| where RemoteIP in ('74.82.197.86', '38.54.50.151')
| extend Description = 'Connection from known malicious IP to VCO host'

// Monitor VCO web access logs for suspicious activity (placeholder - actual log source and fields may vary)
// Replace 'VCOAccessLogs' with your actual log table for VCO web access
VCOAccessLogs
| where Url contains ".." or Url contains "%" or Url matches regex @'\b(localhost|127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})\b' // References to local/internal services
| summarize RequestCount = count() by bin(TimeGenerated, 1h), ClientIP, RequestUri
| where RequestCount > 100 // High request rates (threshold may need adjustment)
| extend Description = 'Suspicious activity in VCO web access logs'

// Monitor for unexpected outbound network activity from the VCO host (placeholder - actual log source and fields may vary)
// Replace 'VCOHostNetworkEvents' with your actual log table for VCO host network activity
VCOHostNetworkEvents
| where InitiatingProcessFileName contains "vco" and RemotePort !in (80, 443) // Example: outbound to non-standard ports
| extend Description = 'Unexpected outbound network activity from VCO host'

Splunk SPL

# Monitor for connections from known malicious IP addresses
index=your_vco_index sourcetype=your_network_logs (dest_ip="74.82.197.86" OR dest_ip="38.54.50.151")
| eval Description = "Connection from known malicious IP to VCO host"

# Monitor VCO web access logs for suspicious activity (placeholder - actual log source and fields may vary)
index=your_vco_index sourcetype=your_vco_access_logs
| regex _raw="\.\.|%|\b(localhost|127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})\b"
| stats count as RequestCount by _time, client_ip, uri
| where RequestCount > 100
| eval Description = "Suspicious activity in VCO web access logs"

# Monitor for unexpected outbound network activity from the VCO host (placeholder - actual log source and fields may vary)
index=your_vco_index sourcetype=your_vco_host_network_logs process="*vco*" NOT (dest_port=80 OR dest_port=443)
| eval Description = "Unexpected outbound network activity from VCO host"

Sigma

title: Arista VeloCloud Orchestrator SQL Injection Exploitation
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a unique GUID
status: experimental
description: Detects potential exploitation attempts against Arista VeloCloud Orchestrator (VCO) SQL injection vulnerability (CVE-2026-114625).
references:
  - https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months/
  - https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html
  - https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/
author: SecBoard
date: 2026/10/23
tags:
  - attack.initial_access
  - attack.privilege_escalation
  - cve.2026.114625
logsource:
  category: webserver
  product: arista_vco # Placeholder, adjust to actual log source
detection:
  selection_iocs:
    c-ip|src_ip|source_ip:
      - '74.82.197.86'
      - '38.54.50.151'
  selection_behavioral_url:
    cs-uri-query|url:
      - '*..*'
      - '*%*'
      - '*localhost*'
      - '*127.0.0.1*'
      - '*10.*.*.*'
      - '*172.1[6-9].*.*'
      - '*172.2[0-9].*.*'
      - '*172.3[0-1].*.*'
      - '*192.168.*.*'
  timeframe: 1h
  condition: selection_iocs or (selection_behavioral_url | stats count() by c-ip | where count() > 100)
falsepositives:
  - Legitimate administrative activity (requires tuning)
level: high

Elastic ES|QL

// Monitor for connections from known malicious IP addresses
from network.connection
| where destination.ip in ('74.82.197.86', '38.54.50.151')
| set @description = 'Connection from known malicious IP to VCO host'

// Monitor VCO web access logs for suspicious activity (placeholder - actual log source and fields may vary)
// Replace 'your_vco_web_access_logs' with your actual log index for VCO web access
from your_vco_web_access_logs
| where url.path : '*..*' or url.path : '*%*' or url.path : '*localhost*' or url.path : '*127.0.0.1*' or url.path : '*10.*.*.**' or url.path : '*172.1[6-9].*.*.*' or url.path : '*172.2[0-9].*.*.*' or url.path : '*172.3[0-1].*.*.*' or url.path : '*192.168.*.*.*'
| summarize request_count = count() by @timestamp, source.ip, url.original
| where request_count > 100 // High request rates (threshold may need adjustment)
| set @description = 'Suspicious activity in VCO web access logs'

// Monitor for unexpected outbound network activity from the VCO host (placeholder - actual log source and fields may vary)
// Replace 'your_vco_host_network_logs' with your actual log index for VCO host network activity
from your_vco_host_network_logs
| where process.name : '*vco*' and not destination.port in (80, 443)
| set @description = 'Unexpected outbound network activity from VCO host'