Sangoma Switchvox CVE-2026-9586 — Unauthenticated SQLi-to-RCE via /pa

Looks for: the core execution primitive of CVE-2026-9586 — PostgreSQL's COPY ... TO PROGRAM handing a command straight to the OS shell. A postgres process spawning a shell interpreter, scripting language, or basic network tool is abnormal on almost any host.

// HUNT: postgres spawning shell / scripting / network tooling — CVE-2026-9586 COPY TO PROGRAM primitive
// MITRE: T1059.004 | CONF: high  FP: low  COST: low | REQUIRES: Falcon sensor (Linux) on the Switchvox host
// LOOKBACK: 7d (set window in the Falcon time picker)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^postgres$/i
| FileName=/^(sh|bash|dash|nc|ncat|netcat|curl|wget|python|python3|perl|awk|base64)$/i
| table([@timestamp, aid, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName])
| sort(@timestamp, order=desc)

Looks for: the exact shape of the initial wild payload (nc <ip> <port> | sh) or a shell spawned with -e /bin/sh. FP: some Linux admins legitimately use nc for one-off diagnostics; exclude known jump-host / bastion admin workstations if they routinely run nc for troubleshooting.

// HUNT: nc/ncat piping to or spawning a shell — reverse-shell execution pattern
// MITRE: T1059.004, T1571 | CONF: high  FP: medium  COST: low | REQUIRES: Falcon sensor (Linux)
// TUNING: exclude known admin/bastion hosts where nc is used for legitimate port-diagnostics; review any hit's ParentBaseFileName before escalating
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(nc|ncat|netcat)$/i
| CommandLine=/(-e\s+\/bin\/(ba)?sh|\|\s*(ba)?sh\b)/i
| table([@timestamp, aid, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName])
| sort(@timestamp, order=desc)

Looks for: the specific post-exploitation reconnaissance pattern Horizon3 documented — a base64-encoded command decoded and piped to bash, matching the observed top -bn1 | awk process-enumeration payload.

// HUNT: base64-encoded command decoded and executed via bash — wild post-exploitation recon pattern
// MITRE: T1057 | CONF: high  FP: low  COST: low | REQUIRES: Falcon sensor (Linux)
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(bash|sh)$/i
| CommandLine=/echo\s+[A-Za-z0-9+\/=]{20,}\s*\|\s*base64\s+-d\s*\|\s*(ba)?sh/i
| table([@timestamp, aid, ComputerName, ParentBaseFileName, CommandLine, UserName])
| sort(@timestamp, order=desc)

Looks for: a wider net around the /pa handler's runtime context — the Apache/nginx/Perl (mod_perl) stack that actually receives the request spawning a shell or basic recon tool, in case the injected command executes in the web-process context rather than directly under postgres. FP: Perl CGI stacks legitimately shell out for some Switchvox provisioning and reporting functions; validate against a known-good baseline of ParentBaseFileName/CommandLine pairs before promoting to a blocking rule.

// HUNT: httpd/apache2/nginx/perl parent spawning a shell or basic recon tool
// MITRE: T1190, T1059.004 | CONF: medium  FP: med-high  COST: low | REQUIRES: Falcon sensor (Linux)
// TUNING: baseline legitimate Perl/CGI child processes for 14 days before alerting; exclude known Switchvox maintenance scripts (e.g. scheduled backup/report generators) by CommandLine pattern
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(httpd|apache2|nginx|perl)$/i
| FileName=/^(sh|bash|nc|ncat|curl|wget|python|python3|perl|id|whoami|uname|chmod)$/i
| table([@timestamp, aid, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName])
| sort(@timestamp, order=desc)

Looks for: outbound connections to the specific attacker source IP / reverse-shell callback port observed by Horizon3's honeypots (176.65.148.184 on TCP/39323).

// HUNT: outbound connection matching the observed CVE-2026-9586 reverse-shell callback
// MITRE: T1571 | CONF: high  FP: low  COST: low | REQUIRES: Falcon sensor (Linux) network telemetry
// LOOKBACK: 30d
#event_simpleName=NetworkConnectIP4
| RemotePort=39323
| RemoteAddressIP4=/^176\.65\.148\.184$/
| table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, LocalAddressIP4, LocalPort])
| sort(@timestamp, order=desc)

Looks for: a behavioral (non-IOC-dependent) variant of Q5 — any external (non-RFC1918) connection made directly by postgres or a bare shell interpreter, which covers reverse shells to infrastructure not yet reported. FP: postgres can legitimately make outbound connections for replication, logical decoding to an external subscriber, or a configured archive_command target — exclude known replication/backup peer addresses.

// HUNT: postgres or bare shell interpreter making an external (non-RFC1918) network connection
// MITRE: T1571 | CONF: medium  FP: medium  COST: medium | REQUIRES: Falcon sensor (Linux) network telemetry
// TUNING: exclude known PostgreSQL replication/archive_command/backup peer addresses; if none are configured for this host, tighten CONF to high
// LOOKBACK: 7d
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(postgres|nc|ncat|sh|bash)$/i
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8","169.254.0.0/16"])
| table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort])
| sort(@timestamp, order=desc)

Looks for: curl/wget invoked from a postgres or shell parent to fetch a file into a world-writable temp location — the pattern reported for the second-stage (reportedly cryptominer) payload. FP: legitimate Switchvox updates or plugin/codec downloads could match; correlate with a subsequent unrecognized long-running process before escalating.

// HUNT: curl/wget child of postgres/shell downloading into a world-writable temp path
// MITRE: T1105, T1496 | CONF: medium  FP: medium  COST: low | REQUIRES: Falcon sensor (Linux)
// TUNING: exclude known Switchvox update/plugin-download maintenance windows; require correlation with a new persistent process (see Q1/Q6) before treating as confirmed compromise
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(postgres|sh|bash)$/i
| FileName=/^(curl|wget)$/i
| CommandLine=/(\-o\s*\/(tmp|var\/tmp|dev\/shm)|\-\-output\s*\/(tmp|var\/tmp|dev\/shm))/i
| table([@timestamp, aid, ComputerName, ParentBaseFileName, CommandLine, UserName])
| sort(@timestamp, order=desc)

Looks for: requests to the vulnerable /pa endpoint at the web-server/reverse-proxy layer — the earliest possible detection point, before any SQLi has to succeed. Requires an NG-SIEM log source for the Switchvox web/reverse-proxy access log; field and source names below are illustrative (snake_case parser fields) and must be validated against your actual ingest configuration. FP: legitimate Polycom phone provisioning traffic also targets /pa — this query is a volumetric/anomaly starting point, not a standalone verdict; pivot on source IP reputation and request volume.

// HUNT: HTTP POST to the vulnerable /pa endpoint — earliest detection point, pre-SQLi
// MITRE: T1190 | CONF: medium  FP: low-med  COST: low | REQUIRES: web/reverse-proxy access log ingested into Falcon NG-SIEM (NOT native sensor telemetry — validate event/source and field names for your ingest before use)
// TUNING: legitimate Polycom phones also call /pa; baseline expected source IPs (your own phone subnet) and alert only on requests from outside that range
// LOOKBACK: 7d
#event_simpleName=HttpRequestEvent
| uri=/^\/pa$/
| http_method=POST
| table([@timestamp, src_ip, uri, http_method, http_user_agent])
| sort(@timestamp, order=desc)