Orkes Conductor — Unauthenticated GraalVM RCE (CVE-2026-58138)

// HUNT: Fleet-Wide Inventory of Hosts Listening on Conductor's Default Port (8080)
// MITRE: T1190 (Exploit Public-Facing Application -- exposure-discovery angle)
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: NetworkListenIP4 on any Falcon-covered host/container
// FALSE POSITIVES: any other service bound to 8080 (Tomcat, Jenkins, custom apps) -- this is an inventory query, not a detection; cross-reference hits with Q2's command-line signature to confirm it is actually Conductor.
// TUNING: once confirmed, maintain the resulting host list as your Conductor asset inventory and scope Q3/Q5/Q6/Q7/Q8/Q9/Q10 to it if you want lower-noise, host-scoped variants.

#event_simpleName=/^NetworkListenIP4$/
| LocalPort=8080
| table([@timestamp, aid, ComputerName, LocalAddressIP4, LocalPort, ContextBaseFileName])
| sort(@timestamp, order=desc)

// HUNT: Fleet-Wide Inventory of Hosts Running a Conductor Server Process
// MITRE: T1190 (exposure-discovery angle)
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 on any Falcon-covered host/container
// FALSE POSITIVES: none expected -- the conductor-server jar name is specific; a hit reliably confirms Conductor is present.
// TUNING: none needed. Cross-reference the CommandLine output against your patch-tracking system to identify which hosts are on the vulnerable 3.21.21-3.30.1 range vs 3.30.2+.

#event_simpleName=/^ProcessRollup2$/
| FileName=/^java$/i
| CommandLine="*conductor-server*"
| groupBy([ComputerName], function=([count(as=Hits), collect([CommandLine], limit=3)]), limit=500)
| sort(Hits, order=desc)

// HUNT: Java (Conductor) Process Spawning a Shell or Interpreter Child -- the Downstream
//       Proxy for GraalVM Sandbox-Escape Execution (the escape itself is in-JVM and not
//       directly visible to Falcon; this is the first process-boundary crossing after it)
// MITRE: T1059.004 (Unix Shell), T1106 (Native API -- proxy), T1105 (Ingress Tool Transfer)
// CONF: high
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2 on any Falcon-covered host/container running Conductor
// FALSE POSITIVES: a small number of legitimate Conductor SHELL-type system tasks or
//   custom subprocess-based task workers may spawn interpreters directly; healthy CI/CD
//   sidecars sharing the same host are also possible.
// TUNING: scope ParentCommandLine to hosts confirmed via Q2 to be running conductor-server;
//   if a specific Conductor deployment legitimately uses SHELL-type tasks, allowlist that
//   task worker's known command-line pattern rather than excluding the whole parent image.

#event_simpleName=/^ProcessRollup2$/
| ParentBaseFileName=/^java$/i
| FileName=in(["sh","bash","dash","ash","curl","wget","python","python3","node","perl","nc","ncat","socat","powershell","pwsh"])
| table([@timestamp, aid, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName])
| sort(@timestamp, order=desc)

// HUNT: New Executable Written Into /tmp (or Similar Working Directory) by a
//       Java-Parented Process -- staged second-stage tooling after RCE
// MITRE: T1105 (Ingress Tool Transfer)
// CONF: medium
// FP: high
// COST: medium
// REQUIRES: ElfFileWritten / NewExecutableWritten on Falcon-covered hosts/containers
// FALSE POSITIVES: the JVM legitimately writes temporary jars, native library extracts,
//   and log/cache files under /tmp constantly during normal operation.
// TUNING: narrow to executable file types only (already done via event selection); cross-
//   reference hits against Q3 output in the same time window -- a temp-dir write that
//   follows a Q3 shell-spawn from the same aid within minutes is materially higher-confidence
//   than either signal alone.

#event_simpleName=/^(ElfFileWritten|NewExecutableWritten)$/
| ContextBaseFileName=/^java$/i
| TargetFileName="/tmp/*"
| table([@timestamp, aid, ComputerName, TargetFileName, ContextBaseFileName, UserName])
| sort(@timestamp, order=desc)

// HUNT: Outbound Connections From the Conductor Process to Public (Non-RFC1918) Addresses
// MITRE: T1071.001 (Application Layer Protocol: Web Protocols)
// CONF: medium
// FP: high
// COST: medium
// REQUIRES: NetworkConnectIP4 on Falcon-covered hosts/containers running Conductor
// FALSE POSITIVES: Conductor's entire job is to call external HTTP task endpoints, webhooks,
//   and SaaS integrations -- legitimate outbound egress is its normal operating behavior, so
//   this query is intentionally broad and high-FP by design.
// TUNING: build an allowlist of your environment's known legitimate Conductor task-integration
//   destinations (webhook targets, SaaS APIs) and exclude them; without that allowlist this
//   query is only useful as a triage aid alongside a Q3/Q4 hit, not as a standalone alert.

#event_simpleName=/^NetworkConnectIP4$/
| ContextBaseFileName=/^java$/i
| CommandLine="*conductor*"
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"])
| table([@timestamp, aid, ComputerName, UserName, RemoteAddressIP4, RemotePort, ContextBaseFileName])
| sort(@timestamp, order=desc)

// HUNT: External Process (curl/wget) Reaching 169.254.169.254 -- Cloud IMDS Credential Theft
// MITRE: T1552.005 (Unsecured Credentials: Cloud Instance Metadata API)
// CONF: high
// FP: low
// COST: low
// REQUIRES: NetworkConnectIP4 on Falcon-covered, cloud-hosted hosts/containers
// FALSE POSITIVES: rare -- legitimate cloud-SDK credential refresh happens IN-PROCESS inside
//   the JVM's own HTTP client and does not spawn curl/wget as a separate process, so this
//   query is scoped specifically to the higher-confidence shelled-out retrieval pattern an
//   attacker's spawned shell would use. A custom health-check or init script invoking curl
//   against the metadata service is the main expected false positive.
// TUNING: if your environment has a known legitimate script that curls the metadata service
//   (e.g. a cloud-init health check), exclude its specific ParentBaseFileName/CommandLine.
// NOTE: 169.254.169.254 is the standard, non-routable IANA link-local cloud-metadata address
//   used by AWS/Azure/GCP/OCI -- it is not attacker infrastructure and is not treated as a
//   provenance-tracked atomic indicator.

#event_simpleName=/^NetworkConnectIP4$/
| RemoteAddressIP4="169.254.169.254"
| ContextBaseFileName=in(["curl","wget"])
| table([@timestamp, aid, ComputerName, ParentBaseFileName, ContextBaseFileName, UserName])
| sort(@timestamp, order=desc)

// HUNT: Java-Parented Shell Reading Environment Variables or Secret-Named Files --
//       Credential/Secret Harvesting From Workflow Definitions or the Process Environment
// MITRE: T1552.001 (Unsecured Credentials: Credentials In Files)
// CONF: medium
// FP: high
// COST: low
// REQUIRES: ProcessRollup2 on Falcon-covered hosts/containers running Conductor
// FALSE POSITIVES: legitimate operational/debug commands ("env", "cat .env") run by admins
//   or CI/CD tooling on the same host are common and will outnumber true positives.
// TUNING: correlate with a Q3 shell-spawn from the same aid in the preceding few minutes;
//   treat an isolated hit with no accompanying Q3 activity as low priority.

#event_simpleName=/^ProcessRollup2$/
| ParentBaseFileName=/^java$/i
| FileName=/^(cat|env|printenv|grep|find)$/i
| CommandLine=/(secret|password|credential|token|apikey|\.env)/i
| table([@timestamp, aid, ComputerName, FileName, CommandLine, UserName])
| sort(@timestamp, order=desc)

// HUNT: Bash /dev/tcp Pseudo-Device Reverse Shell (Any Parent, Fleet-Wide)
// MITRE: T1059 (adjacent) -- classic post-RCE interactive reverse shell technique
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 on any Falcon-covered host (not scoped to Conductor)
// FALSE POSITIVES: rare -- legitimate scripts occasionally use /dev/tcp for lightweight
//   port-checks, but the pattern is uncommon enough that any hit warrants review.
// TUNING: none required for the base query. If a known internal tool legitimately uses this
//   syntax for health checks, allowlist its specific ComputerName/CommandLine pattern.
// NOTE: this is a GENERIC post-exploitation pattern, not a confirmed Orkes Conductor campaign
//   TTP -- it is precedented by the analogous, CISA-referenced Kestra OSS (CVE-2026-49869)
//   case (see Section 2), shipped here as defense-in-depth for ANY unauthenticated-RCE
//   foothold including this one.

#event_simpleName=/^ProcessRollup2$/
| CommandLine="*dev/tcp*"
| table([@timestamp, aid, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName])
| sort(@timestamp, order=desc)

// HUNT: Known Cryptominer Binary Names Spawned From a Java/Shell/Curl/Wget Lineage
// MITRE: T1496 (Resource Hijacking)
// CONF: medium
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 on Falcon-covered hosts/containers running Conductor
// FALSE POSITIVES: none expected under normal operation -- but attackers commonly rename
//   miner binaries, so this is a low-recall, high-precision opportunistic net-catch, not a
//   primary detection. Do not rely on this alone.
// TUNING: none needed; supplement with generic CPU/thermal anomaly monitoring outside CQL
//   scope for miners that use an unlisted binary name.
// NOTE: this is a GENERIC post-exploitation pattern, not a confirmed Orkes Conductor campaign
//   TTP -- see the Section 2 callout on the CISA/Kestra reverse-shell-and-miner precedent.

#event_simpleName=/^ProcessRollup2$/
| ParentBaseFileName=in(["java","sh","bash","curl","wget"])
| FileName=/^(xmrig|minerd|cpuminer|kinsing|xmr-stak|ccminer|t-rex|phoenixminer)$/i
| table([@timestamp, aid, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName])
| sort(@timestamp, order=desc)

// HUNT: Crontab/Systemd Modification Invoked From a Java or Shell Parent -- Post-RCE Persistence
// MITRE: T1053.003 (Scheduled Task/Job: Cron), T1543.002 (Systemd Service)
// CONF: medium-high
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2 on Falcon-covered hosts/containers running Conductor
// FALSE POSITIVES: configuration-management tooling (Ansible, Chef, Puppet) legitimately runs
//   crontab/systemctl, but is very rarely parented directly by the Conductor JVM or one of its
//   shell children -- most legitimate CM tooling runs as its own top-level process.
// TUNING: exclude your known CM/orchestration tooling's process lineage if it is genuinely
//   parented by java for some reason in your environment; note this is much weaker signal on
//   ephemeral Kubernetes pods, which rarely persist cron/systemd changes across restarts.

#event_simpleName=/^ProcessRollup2$/
| ParentBaseFileName=in(["java","sh","bash"])
| FileName=/^(crontab|systemctl|systemd-run|at)$/i
| table([@timestamp, aid, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName])
| sort(@timestamp, order=desc)