CVE-2026-63004

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessFileName contains "unleash" or InitiatingProcessCommandLine contains "unleash"
| where RemoteIP startswith "10." or RemoteIP startswith "172.16." or RemoteIP startswith "172.17." or RemoteIP startswith "172.18." or RemoteIP startswith "172.19." or RemoteIP startswith "172.20." or RemoteIP startswith "172.21." or RemoteIP startswith "172.22." or RemoteIP startswith "172.23." or RemoteIP startswith "172.24." or RemoteIP startswith "172.25." or RemoteIP startswith "172.26." or RemoteIP startswith "172.27." or RemoteIP startswith "172.28." or RemoteIP startswith "172.29." or RemoteIP startswith "172.30." or RemoteIP startswith "172.31." or RemoteIP startswith "192.168." or RemoteIP startswith "169.254."
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, Protocol, ActionType

Splunk SPL

index=* (process_name="unleash" OR command_line="*unleash*") (dest_ip=10.* OR dest_ip=172.16.* OR dest_ip=172.17.* OR dest_ip=172.18.* OR dest_ip=172.19.* OR dest_ip=172.20.* OR dest_ip=172.21.* OR dest_ip=172.22.* OR dest_ip=172.23.* OR dest_ip=172.24.* OR dest_ip=172.25.* OR dest_ip=172.26.* OR dest_ip=172.27.* OR dest_ip=172.28.* OR dest_ip=172.29.* OR dest_ip=172.30.* OR dest_ip=172.31.* OR dest_ip=192.168.* OR dest_ip=169.254.*)
| table _time, host, process_name, command_line, dest_ip, dest_port, protocol

Sigma

title: Unleash SSRF Attempt
author: SecBoard
description: Detects potential SSRF attempts from Unleash by monitoring outgoing connections to private IP ranges or cloud metadata endpoints.
logsource:
  category: network_connection
  product: linux
  service: auditd
detection:
  selection:
    Image|endswith: 'unleash'
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '192.168.'
      - '169.254.'
  condition: selection
level: medium

Elastic ES|QL

from network where process.name : "unleash" or process.command_line : "*unleash*" and (destination.ip : "10.*" or destination.ip : "172.16.*" or destination.ip : "172.17.*" or destination.ip : "172.18.*" or destination.ip : "172.19.*" or destination.ip : "172.20.*" or destination.ip : "172.21.*" or destination.ip : "172.22.*" or destination.ip : "172.23.*" or destination.ip : "172.24.*" or destination.ip : "172.25.*" or destination.ip : "172.26.*" or destination.ip : "172.27.*" or destination.ip : "172.28.*" or destination.ip : "172.29.*" or destination.ip : "172.30.*" or destination.ip : "172.31.*" or destination.ip : "192.168.*" or destination.ip : "169.254.*") | select @timestamp, host.name, process.name, process.command_line, destination.ip, destination.port, network.protocol