CVE-2026-9862 — Fortra Core PAM (BoKS) Unauthenticated Command Injection

Looks for: any process whose parent is boks_autoregisterd. Accomplishes: the highest-fidelity signal — the autoregistration daemon should not spawn children; a child = command injection. FP: low — baseline first to learn any benign helper the daemon legitimately forks, then exclude it.

// HUNT: CVE-2026-9862 command injection — boks_autoregisterd child spawn (T1190 / T1059.004)
// CONF: high  FP: low  COST: low | REQUIRES: Falcon Linux ProcessRollup2 on BoKS hosts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^boks_autoregisterd$/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: a child of boks_autoregisterd that is a shell, scripting interpreter, or recon utility. Accomplishes: tightens Q1 to the classic command-injection follow-ons. FP: low — none expected from a registration daemon.

// HUNT: CVE-2026-9862 injected shell/recon (T1059.004)
// CONF: high  FP: low  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^boks_autoregisterd$/i
| CommandLine=/\b(sh|bash|dash|ksh|zsh|python\d?|perl|awk)\b\s+-c|\b(id|whoami|uname|hostname|cat|ls|env)\b/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: connections involving the autoregister port 6507. Accomplishes: surfaces who is reaching the exposed service. FP: medium — legitimate BoKS clients register over 6507; allow-list your known client subnets so only unexpected sources alert.

// HUNT: CVE-2026-9862 autoregister port exposure (T1190)
// CONF: medium  FP: medium  COST: low
// TUNING: exclude RemoteAddressIP4 of sanctioned BoKS-client subnets; alert on the rest
#event_simpleName=/NetworkConnectIP4|NetworkListenIP4|NetworkReceiveIP4/
| (RemotePort=6507 or LocalPort=6507)
| groupBy([aid, ComputerName, RemoteAddressIP4, RemotePort, LocalPort], function=[count()])
| sort(_count, order=desc)

Looks for: download-and-run / decode-and-run patterns parented by a BoKS daemon. Accomplishes: catches ingress tool transfer right after injection. FP: low when scoped to the BoKS daemon parent; verify any hit.

// HUNT: CVE-2026-9862 payload retrieval from service context (T1105)
// CONF: high  FP: low  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^boks_/i
| CommandLine=/(curl|wget|fetch).{0,80}(\bsh\b|bash|\| ?sh)|chmod\s+\+?x|base64\s+-d|\/dev\/tcp\//i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: cron/systemd edits, SSH authorized_keys writes, or back-connect shells run on the BoKS host. Accomplishes: catches the persistence/RAT stage. FP: medium — admins legitimately edit cron/keys; allow-list change-window AIDs and known admin accounts.

// HUNT: CVE-2026-9862 persistence / reverse shell on BoKS host (T1053.003 / T1098.004 / T1571)
// CONF: medium  FP: medium  COST: low
// TUNING: exclude known admin AIDs and scheduled change-window maintenance
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(crontab\s+-|systemctl\s+(enable|daemon-reload)|authorized_keys|nc\s+-e|ncat\s+.{0,20}-e|bash\s+-i|\/dev\/tcp\/|mkfifo.{0,30}\| ?(sh|bash))/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: writes to BoKS configuration (e.g. boksinit) — used both as the vendor mitigation and as an attacker tamper target. Accomplishes: watches for control-weakening edits. FP: medium — legitimate admin/patch activity edits these; correlate with change tickets and allow-list maintenance windows.

// HUNT: CVE-2026-9862 BoKS config tamper (T1562.001)
// CONF: medium  FP: medium  COST: low
// TUNING: exclude approved patch/maintenance AIDs and change windows
#event_simpleName=/RawFileModified|FileWritten/
| TargetFileName=/boksinit|boks.{0,12}\.(conf|cfg)$/i
| table([@timestamp, aid, ComputerName, UserName, TargetFileName], limit=200)
| sort(@timestamp, order=desc)