CVE-2026-76506

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "httpd.exe" or InitiatingProcessFileName =~ "tomcat.exe" // Adjust based on actual web server process name
| where FileName !in ("cmd.exe", "powershell.exe", "sh", "bash") // Exclude common legitimate shell processes if not directly spawned by web server
| where ProcessCommandLine contains "-c" or ProcessCommandLine contains "/c" or ProcessCommandLine contains "-exec" // Look for command execution patterns
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath
| join kind=leftouter (
    DeviceFileEvents
    | where InitiatingProcessFileName =~ "httpd.exe" or InitiatingProcessFileName =~ "tomcat.exe" // Adjust based on actual web server process name
    | where ActionType == "FileCreated" or ActionType == "FileWritten"
    | project Timestamp, DeviceName, FileName as CreatedFileName, FolderPath as CreatedFolderPath, InitiatingProcessFileName as FileInitiatingProcess
) on DeviceName, $left.Timestamp between ($right.Timestamp - 1m .. $right.Timestamp + 1m)
| where InitiatingProcessFileName == FileInitiatingProcess // Correlate process execution with file writes from the same web server process
| summarize by Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, CreatedFileName, CreatedFolderPath
| extend AlertMessage = "Potential RCE via Cisco UCS Central Software vulnerability (CVE-2026-76506)"

Splunk SPL

(sourcetype=cisco_ucs_central_logs OR sourcetype=syslog) (process="httpd" OR process="tomcat") (action=exec OR action=write) (command=* OR file_created=*)
| eval potential_rce = if(match(_raw, "(exec|write).*command=.*") OR match(_raw, "(exec|write).*file_created=.*"), 1, 0)
| where potential_rce=1
| stats count by _time, host, process, command, file_created, _raw
| rename host as Host, process as Process, command as Command, file_created as FileCreated
| table _time, Host, Process, Command, FileCreated, _raw
| fields - potential_rce
| `comment("Adjust sourcetypes and field names based on actual log configurations for Cisco UCS Central Software and system processes.")`

Sigma

title: Cisco UCS Central Software RCE Attempt
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a real UUID
status: experimental
description: Detects potential remote code execution attempts against Cisco UCS Central Software via its web-based management interface (CVE-2026-76506).
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucs-rce-LzHSFRDQ
logsource:
  category: process_creation
  product: windows # Or linux, depending on UCS Central OS
detection:
  selection_process:
    ParentImage|endswith:
      - '\httpd.exe'
      - '\tomcat.exe' # Adjust based on actual web server process
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sh'
      - '\bash'
    CommandLine|contains:
      - '-c'
      - '/c'
      - '-exec'
  selection_file_write:
    EventID: 11 # For Sysmon FileCreate event, adjust for other EDRs
    Image|endswith:
      - '\httpd.exe'
      - '\tomcat.exe' # Adjust based on actual web server process
    TargetFilename|endswith:
      - '.jsp'
      - '.php'
      - '.sh'
      - '.bat'
      - '.ps1'
      - '.exe'
  condition: selection_process or selection_file_write
level: high

Elastic ES|QL

from process where event.type == "start" and (process.parent.executable.name == "httpd.exe" or process.parent.executable.name == "tomcat.exe") and (process.executable.name == "cmd.exe" or process.executable.name == "powershell.exe" or process.executable.name == "sh" or process.executable.name == "bash") and (process.args contains "-c" or process.args contains "/c" or process.args contains "-exec")
union
from file where event.type == "creation" and (process.executable.name == "httpd.exe" or process.executable.name == "tomcat.exe") and (file.extension == "jsp" or file.extension == "php" or file.extension == "sh" or file.extension == "bat" or file.extension == "ps1" or file.extension == "exe")
| project @timestamp, host.name, process.parent.executable.name, process.executable.name, process.command_line, file.path, event.action
| rename host.name as Host, process.parent.executable.name as ParentProcess, process.executable.name as Process, process.command_line as CommandLine, file.path as FilePath, event.action as Action
| sort by @timestamp desc
| `comment("Adjust process and file names based on actual environment and log sources.")`