CVE-2026-76443

Sentinel/Defender KQL

// This query attempts to detect anomalous process creation or command execution indicative of injection vulnerabilities (CWE-707).
// Look for processes spawned by the Cisco Secure Email Gateway or Secure Email and Web Manager that execute unusual commands or scripts.
DeviceProcessEvents
| where InitiatingProcessFileName in ("esa_process.exe", "swe_manager_process.exe") // Placeholder process names, adjust based on actual Cisco product processes
| where FileName in ("cmd.exe", "powershell.exe", "sh", "bash") or ProcessCommandLine contains ("sql", "eval", "script")
| where ProcessCommandLine matches regex @"(?i)(union select|insert into|update set|delete from|exec\s+\w+|xp_cmdshell|javascript:|<script>)"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, FolderPath
| extend DetectionNotes = "Potential injection attempt via Cisco Secure Email Gateway/Manager"

Splunk SPL

# This query attempts to detect anomalous process creation or command execution indicative of injection vulnerabilities (CWE-707).
# Look for processes spawned by the Cisco Secure Email Gateway or Secure Email and Web Manager that execute unusual commands or scripts.
index=your_cisco_logs_index sourcetype=your_cisco_sourcetype (process_name="esa_process.exe" OR process_name="swe_manager_process.exe") (command="cmd.exe" OR command="powershell.exe" OR command="sh" OR command="bash" OR command_line=*sql* OR command_line=*eval* OR command_line=*script*)
| rex field=command_line "(?i)(?<injection_pattern>union select|insert into|update set|delete from|exec\s+\w+|xp_cmdshell|javascript:|<script>)"
| where isnotnull(injection_pattern)
| table _time, host, process_name, command, command_line, user
| rename _time as Time, host as Host, process_name as ProcessName, command as Command, command_line as CommandLine, user as User
| eval DetectionNotes = "Potential injection attempt via Cisco Secure Email Gateway/Manager"

Sigma

title: Cisco Secure Email Gateway/Manager Injection Attempt
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a unique GUID
status: experimental
description: Detects potential injection attempts (SQL, command, code) originating from Cisco Secure Email Gateway or Secure Email and Web Manager processes.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm
author: SecBoard
date: 2026/09/14
logsource:
  category: process_creation
  product: windows # Or linux, depending on the OS where Cisco products run
detection:
  selection:
    ParentImage|endswith:
      - '\esa_process.exe' # Placeholder, adjust based on actual Cisco product processes
      - '\swe_manager_process.exe' # Placeholder, adjust based on actual Cisco product processes
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sh'
      - '\bash'
    CommandLine|contains:
      - 'union select'
      - 'insert into'
      - 'update set'
      - 'delete from'
      - 'exec '
      - 'xp_cmdshell'
      - 'javascript:'
      - '<script>'
  condition: selection
fields:
  - CommandLine
  - ParentImage
  - Image
tags:
  - attack.initial_access
  - attack.t1190 # Exploit Public-Facing Application
  - cve.2026.76443
  - cwe.707

Elastic ES|QL

// This query attempts to detect anomalous process creation or command execution indicative of injection vulnerabilities (CWE-707).
// Look for processes spawned by the Cisco Secure Email Gateway or Secure Email and Web Manager that execute unusual commands or scripts.
from process where 
  (process.parent.executable.name : ("esa_process.exe", "swe_manager_process.exe") or 
   process.parent.args : ("esa_process.exe", "swe_manager_process.exe")) and
  (process.executable.name : ("cmd.exe", "powershell.exe", "sh", "bash") or 
   process.args : ("*sql*", "*eval*", "*script*")) and
  (process.args : ".*union select.*" or 
   process.args : ".*insert into.*" or 
   process.args : ".*update set.*" or 
   process.args : ".*delete from.*" or 
   process.args : ".*exec\s+\w+.*" or 
   process.args : ".*xp_cmdshell.*" or 
   process.args : ".*javascript:.*" or 
   process.args : ".*<script>.*")
| project @timestamp, host.name, process.parent.executable.name, process.executable.name, process.args, user.name
| append [ "DetectionNotes", "Potential injection attempt via Cisco Secure Email Gateway/Manager" ]