CVE-2026-59310

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "syslogd" or FileName =~ "syslogd" // Adjust based on actual syslog process name
| where ProcessCommandLine has_any ("ssh", "reverse_shell", "ransomware", "babuk") or FolderPath contains "syslog" and (ProcessCommandLine has_any ("powershell", "cmd.exe", "sh", "bash")) // Look for suspicious commands or shell activity originating from or targeting syslog related paths
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, SHA256

Splunk SPL

(sourcetype="syslog" OR sourcetype="vmware:vcenter:log") (syslogd OR "syslog server") (ssh OR reverse_shell OR ransomware OR babuk OR powershell OR cmd.exe OR sh OR bash)
| table _time, host, source, _raw
| search _raw IN (*ssh*, *reverse_shell*, *ransomware*, *babuk*) OR (_raw IN (*syslog*) AND _raw IN (*powershell*, *cmd.exe*, *sh*, *bash*))

Sigma

title: VMware vCenter Syslog Directory Traversal Exploitation
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential exploitation of CVE-2026-59310 in VMware vCenter Syslog server.
author: SecBoard
date: 2026/09/17
logsource:
  product: linux
  service: syslog
detection:
  selection:
    ParentImage|endswith: 'syslogd'
    CommandLine|contains:
      - 'ssh'
      - 'reverse_shell'
      - 'ransomware'
      - 'babuk'
      - 'powershell'
      - 'cmd.exe'
      - 'sh'
      - 'bash'
  condition: selection
level: critical

Elastic ES|QL

from process where process.parent.name == "syslogd" and (process.command_line : ("ssh", "reverse_shell", "ransomware", "babuk") or (process.command_line : ("powershell", "cmd.exe", "sh", "bash") and process.working_directory : "*syslog*"))