CVE-2026-57202

Sentinel/Defender KQL

let dangerous_functions = dynamic(["FILE(", "SHELL(", "CURL(", "STAT(", "DB("]);
AsteriskLogs
| where EventType == "ARI_setChannelVar"
| where VariableValue has_any (dangerous_functions)
| where Configuration_live_dangerously == "no" // Assuming this config can be logged or correlated
| project TimeGenerated, SourceIp, UserName, ChannelId, VariableName, VariableValue, Configuration_live_dangerously, RawData

Splunk SPL

sourcetype=asterisk_logs EventType="ARI_setChannelVar" (VariableValue=*FILE\(* OR VariableValue=*SHELL\(* OR VariableValue=*CURL\(* OR VariableValue=*STAT\(* OR VariableValue=*DB\(*)
| search Configuration_live_dangerously="no" // Assuming this config can be logged or correlated
| table _time, SourceIp, UserName, ChannelId, VariableName, VariableValue, Configuration_live_dangerously

Sigma

title: Asterisk ARI Dangerous Dialplan Function Call
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects attempts to call dangerous dialplan functions via ARI setChannelVar when live_dangerously is disabled.
author: SecBoard
date: 2024/01/01
logsource:
  product: asterisk
  service: logs
detection:
  selection:
    EventType: 'ARI_setChannelVar'
    VariableValue|contains:
      - 'FILE('
      - 'SHELL('
      - 'CURL('
      - 'STAT('
      - 'DB('
  condition: selection
fields:
  - SourceIp
  - UserName
  - ChannelId
  - VariableName
  - VariableValue
tags:
  - attack.privilege_escalation
  - cve.2026.57202

Elastic ES|QL

from asterisk_logs
| where event.type == "ARI_setChannelVar"
| where message : ("FILE(", "SHELL(", "CURL(", "STAT(", "DB(")
| where asterisk.config.live_dangerously == "no" // Assuming this config can be logged or correlated
| select @timestamp, source.ip, user.name, asterisk.channel.id, asterisk.variable.name, asterisk.variable.value, asterisk.config.live_dangerously