STIX 2.1 Alert

A forecasted alert has been generated for a potential zero-day threat targeting Wazuh, with an estimated peak exploitation date of 2026-08-15. The last critical fix for this vendor was CVE-2026-25769, a Remote Code Execution (RCE) vulnerability caused by unsafe JSON deserialization using a custom object_hook in the cluster communication mechanism [1.3]. It is highly recommended to create a detection token looking for the Potential Detection Tracks to identify early signs of exploitation.

Most Recent Criticality SIGMA Logic

title: Detect Wazuh Master Node Unsafe Deserialization (CVE-2026-25769)
id: a1b2c3d4-e5f6-7890-1234-567890abcdef
status: experimental
description: Detects exploitation of unsafe JSON deserialization in Wazuh cluster communication.
author: logforce.com
date: 2026/05/02
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/wazuh-clusterd'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/python'
  condition: selection
falsepositives:
  - Legitimate cluster management scripts
level: critical

Predictive SIGMA Logic

title: Predictive Detection of Wazuh Cluster Anomalies
id: b2c3d4e5-f6a7-8901-2345-67890abcdef1
status: experimental
description: Detects anomalous cluster communication or payload injection attempts targeting Wazuh master/worker nodes.
author: logforce.com
date: 2026/05/02
logsource:
  category: network
  product: wazuh
detection:
  selection:
    DestinationPort: 1516
    Payload|contains:
      - 'import '
      - '__import__'
      - 'eval('
      - 'exec('
  condition: selection
falsepositives:
  - Unknown
level: high

LLM Detection Prompt

LLM Prompt: Analyze Wazuh cluster communication logs and master node process executions for anomalous JSON payloads containing unexpected Python module imports, or the spawning of suspicious child processes (e.g., sh, bash, cmd) originating from the Wazuh manager service.

STIX 2.1 Alert

A forecasted alert has been generated for a potential zero-day threat targeting Quest KACE Systems Management Appliance (SMA), with an estimated peak exploitation date of 2026-08-28. The last critical fix for this vendor was CVE-2025-32975, a critical authentication bypass vulnerability in the SSO handling mechanism that allows unauthenticated attackers to impersonate legitimate users and achieve administrative takeover. It is highly recommended to create a detection token looking for the Potential Detection Tracks to identify early signs of exploitation.

Most Recent Criticality SIGMA Logic

title: Detect Quest KACE SMA Auth Bypass (CVE-2025-32975)
id: c3d4e5f6-a7b8-9012-3456-7890abcdef12
status: experimental
description: Detects suspicious admin account creation via runkbot.exe indicative of Quest KACE SMA exploitation.
author: logforce.com
date: 2026/05/02
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\runkbot.exe'
    CommandLine|contains:
      - 'net localgroup administrators'
      - '/add'
  condition: selection
falsepositives:
  - Legitimate KACE SMA administrative tasks
level: critical

Predictive SIGMA Logic

title: Predictive Detection of Quest KACE SMA Anomalies
id: d4e5f6a7-b8c9-0123-4567-890abcdef123
status: experimental
description: Detects anomalous SSO requests or unexpected administrative actions on Quest KACE SMA.
author: logforce.com
date: 2026/05/02
logsource:
  category: webserver
  product: quest_kace
detection:
  selection:
    uri_path|contains: '/sso/'
    status:
      - 200
      - 302
    user_agent|contains:
      - 'curl'
      - 'python-requests'
  condition: selection
falsepositives:
  - Automated API integrations
level: high

LLM Detection Prompt

LLM Prompt: Monitor Quest KACE SMA authentication and system logs for unusual SSO token usage, unexpected administrative account creation via runkbot.exe, or anomalous execution of PowerShell scripts in hidden contexts.

STIX 2.1 Alert

A forecasted alert has been generated for a potential zero-day threat targeting Flowise, with an estimated peak exploitation date of 2026-08-21. The last critical fix for this vendor was CVE-2026-41268, an unauthenticated Remote Command Execution (RCE) vulnerability exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODE_OPTIONS environment variable injection. It is highly recommended to create a detection token looking for the Potential Detection Tracks to identify early signs of exploitation.

Most Recent Criticality SIGMA Logic

title: Detect Flowise FILE-STORAGE RCE (CVE-2026-41268)
id: e5f6a7b8-c9d0-1234-5678-90abcdef1234
status: experimental
description: Detects FILE-STORAGE:: keyword combined with NODE_OPTIONS environment variable injection in Flowise.
author: logforce.com
date: 2026/05/02
logsource:
  category: webserver
  product: flowise
detection:
  selection:
    uri_query|contains|all:
      - 'FILE-STORAGE::'
      - 'NODE_OPTIONS'
  condition: selection
falsepositives:
  - None expected
level: critical

Predictive SIGMA Logic

title: Predictive Detection of Flowise Parameter Overrides
id: f6a7b8c9-d0e1-2345-6789-0abcdef12345
status: experimental
description: Detects anomalous parameter overrides or unexpected environment variable injections in Flowise API.
author: logforce.com
date: 2026/05/02
logsource:
  category: webserver
  product: flowise
detection:
  selection:
    uri_path|contains: '/api/v1/'
    uri_query|contains:
      - 'overrideConfig'
      - 'env='
  condition: selection
falsepositives:
  - Legitimate configuration overrides
level: high

LLM Detection Prompt

LLM Prompt: Analyze Flowise API requests and container logs for suspicious parameter overrides, specifically looking for the 'FILE-STORAGE::' keyword, 'NODE_OPTIONS' environment variable injections, or unexpected root-level command execution.

STIX 2.1 Alert

A forecasted alert has been generated for a potential zero-day threat targeting Flowise, with an estimated peak exploitation date of 2026-08-20. The last critical fix for this vendor was CVE-2025-59528, a critical vulnerability allowing remote code execution due to improper validation of user-supplied JavaScript code in the CustomMCP server configuration logic. It is highly recommended to create a detection token looking for the Potential Detection Tracks to identify early signs of exploitation.

Most Recent Criticality SIGMA Logic

title: Detect Flowise CustomMCP JavaScript Injection (CVE-2025-59528)
id: a7b8c9d0-e1f2-3456-7890-abcdef123456
status: experimental
description: Detects malicious JavaScript payloads in CustomMCP configuration settings.
author: logforce.com
date: 2026/05/02
logsource:
  category: webserver
  product: flowise
detection:
  selection:
    uri_path|contains: '/api/v1/mcp'
    payload|contains:
      - 'child_process'
      - 'require('
      - 'eval('
  condition: selection
falsepositives:
  - Legitimate MCP configurations
level: critical

Predictive SIGMA Logic

title: Predictive Detection of Flowise Node.js Anomalies
id: b8c9d0e1-f2a3-4567-8901-bcdef1234567
status: experimental
description: Detects anomalous JavaScript execution or unexpected child processes spawned by Flowise Node.js runtime.
author: logforce.com
date: 2026/05/02
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/node'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/wget'
      - '/curl'
  condition: selection
falsepositives:
  - Legitimate node modules spawning shells
level: high

LLM Detection Prompt

LLM Prompt: Monitor Flowise CustomMCP configuration endpoints for unauthorized JavaScript payloads, and analyze Node.js runtime logs for anomalous child process spawning or unauthorized file system access.

STIX 2.1 Alert

A forecasted alert has been generated for a potential zero-day threat targeting Cisco Identity Services Engine (ISE), with an estimated peak exploitation date of 2026-08-14. The last critical fix for this vendor was CVE-2026-20147, an insufficient validation of user-supplied input vulnerability that allows an authenticated, remote attacker to achieve remote code execution by sending crafted HTTP requests. It is highly recommended to create a detection token looking for the Potential Detection Tracks to identify early signs of exploitation.

Most Recent Criticality SIGMA Logic

title: Detect Cisco ISE RCE and Path Traversal (CVE-2026-20147)
id: c9d0e1f2-a3b4-5678-9012-cdef12345678
status: experimental
description: Detects crafted HTTP requests targeting Cisco ISE endpoints for path traversal or command injection.
author: logforce.com
date: 2026/05/02
logsource:
  category: webserver
  product: cisco_ise
detection:
  selection:
    uri_path|contains:
      - '../'
      - '..%2f'
      - '%2e%2e%2f'
      - '/admin/'
  condition: selection
falsepositives:
  - Vulnerability scanners
level: critical

Predictive SIGMA Logic

title: Predictive Detection of Cisco ISE Anomalies
id: d0e1f2a3-b4c5-6789-0123-def123456789
status: experimental
description: Detects anomalous administrative HTTP requests or unexpected shell execution on Cisco ISE nodes.
author: logforce.com
date: 2026/05/02
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: 'ise'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/whoami'
  condition: selection
falsepositives:
  - Administrative troubleshooting
level: high

LLM Detection Prompt

LLM Prompt: Analyze Cisco ISE access and audit logs for suspicious HTTP requests containing path traversal sequences or command injection payloads targeting administrative endpoints, and monitor for unexpected root privilege escalation.

STIX 2.1 Alert

A forecasted alert has been generated for a potential zero-day threat targeting Progress Software MOVEit Automation, with an estimated peak exploitation date of 2026-08-13. The last critical fix for this vendor was CVE-2026-4670, a critical authentication bypass vulnerability that allows an unauthenticated remote attacker to gain unauthorized access to the platform. It is highly recommended to create a detection token looking for the Potential Detection Tracks to identify early signs of exploitation.

Most Recent Criticality SIGMA Logic

title: Detect Progress MOVEit Automation Auth Bypass (CVE-2026-4670)
id: e1f2a3b4-c5d6-7890-1234-ef1234567890
status: experimental
description: Detects authentication bypass attempts or unauthorized access to MOVEit Automation configuration endpoints.
author: logforce.com
date: 2026/05/02
logsource:
  category: webserver
  product: moveit_automation
detection:
  selection:
    uri_path|contains: '/api/v1/'
    status: 200
  filter:
    user_agent|contains: 'MOVEit'
  condition: selection and not filter
falsepositives:
  - Legitimate API usage
level: critical

Predictive SIGMA Logic

title: Predictive Detection of MOVEit Automation Anomalies
id: f2a3b4c5-d6e7-8901-2345-f1234567890a
status: experimental
description: Detects anomalous network access or unexpected administrative actions on Progress MOVEit Automation servers.
author: logforce.com
date: 2026/05/02
logsource:
  category: network
  product: windows
detection:
  selection:
    DestinationPort:
      - 443
      - 80
    Initiated: 'true'
    Image|endswith: '\miadmin.exe'
  condition: selection
falsepositives:
  - Legitimate admin actions
level: high

LLM Detection Prompt

LLM Prompt: Monitor Progress MOVEit Automation access logs for unauthenticated requests attempting to access administrative or configuration endpoints, and analyze network traffic for anomalous file transfer activities.

STIX 2.1 Alert

A forecasted alert has been generated for a potential zero-day threat targeting Flowise, with an estimated peak exploitation date of 2026-06-26. The last critical fix for this vendor was CVE-2026-41271, a Server-Side Request Forgery (SSRF) vulnerability in the POST/GET API Chain components that allows attackers to force the server to make arbitrary HTTP requests via malicious prompt templates. It is highly recommended to create a detection token looking for the Potential Detection Tracks to identify early signs of exploitation.

Most Recent Criticality SIGMA Logic

title: Detect Flowise SSRF via API Chain (CVE-2026-41271)
id: a3b4c5d6-e7f8-9012-3456-1234567890ab
status: experimental
description: Detects SSRF attempts via malicious prompt templates targeting internal services in Flowise.
author: logforce.com
date: 2026/05/02
logsource:
  category: webserver
  product: flowise
detection:
  selection:
    uri_path|contains: '/api/v1/components'
    payload|contains:
      - '127.0.0.1'
      - 'localhost'
      - '169.254.169.254'
      - '10.'
      - '192.168.'
  condition: selection
falsepositives:
  - Legitimate internal integrations
level: critical

Predictive SIGMA Logic

title: Predictive Detection of Flowise Outbound Anomalies
id: b4c5d6e7-f8a9-0123-4567-234567890abc
status: experimental
description: Detects anomalous outbound HTTP requests from Flowise server to internal network ranges.
author: logforce.com
date: 2026/05/02
logsource:
  category: network
  product: linux
detection:
  selection:
    Image|endswith: '/node'
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '169.254.'
  condition: selection
falsepositives:
  - Legitimate internal API calls
level: high

LLM Detection Prompt

LLM Prompt: Analyze Flowise prompt templates and API Chain component configurations for suspicious URLs targeting internal network infrastructure, and monitor outbound HTTP requests for anomalous destinations.

STIX 2.1 Alert

A forecasted alert has been generated for a potential zero-day threat targeting the n8n workflow automation platform, with an estimated peak exploitation date of 2026-06-20. The last critical fix for this vendor was CVE-2026-27493, a double-evaluation bug in n8n's Form nodes that allows unauthenticated expression evaluation and potential remote code execution. It is highly recommended to create a detection token looking for the Potential Detection Tracks to identify early signs of exploitation.

Most Recent Criticality SIGMA Logic

title: Detect n8n Form Node Expression Injection (CVE-2026-27493)
id: c5d6e7f8-a9b0-1234-5678-34567890abcd
status: experimental
description: Detects expression injection payloads in n8n Form node submissions.
author: logforce.com
date: 2026/05/02
logsource:
  category: webserver
  product: n8n
detection:
  selection:
    uri_path|contains: '/webhook/'
    payload|contains:
      - '{{'
      - '}}'
      - '$runWith'
      - 'child_process'
  condition: selection
falsepositives:
  - Legitimate form submissions containing brackets
level: critical

Predictive SIGMA Logic

title: Predictive Detection of n8n Execution Anomalies
id: d6e7f8a9-b0c1-2345-6789-4567890abcde
status: experimental
description: Detects anomalous expression evaluation or unexpected system command execution originating from n8n workflows.
author: logforce.com
date: 2026/05/02
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/n8n'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/curl'
      - '/wget'
  condition: selection
falsepositives:
  - Legitimate workflow shell executions
level: high

LLM Detection Prompt

LLM Prompt: Monitor n8n Form node submissions for suspicious expression injection payloads, and analyze workflow execution logs for unexpected shell command execution or unauthorized access to sensitive files.

STIX 2.1 Alert

A forecasted alert has been generated for a potential zero-day threat targeting Hugging Face LeRobot, with an estimated peak exploitation date of 2026-04-11. The last critical fix for this vendor was CVE-2026-25874, an unauthenticated Remote Code Execution (RCE) vulnerability caused by unsafe deserialization of untrusted data using Python's pickle module over exposed gRPC endpoints in the PolicyServer component. It is highly recommended to create a detection token looking for the Potential Detection Tracks to identify early signs of exploitation.

Most Recent Criticality SIGMA Logic

title: Detect Hugging Face LeRobot Pickle Deserialization (CVE-2026-25874)
id: e7f8a9b0-c1d2-3456-7890-567890abcdef
status: experimental
description: Detects malicious serialized pickle payloads sent to LeRobot PolicyServer gRPC endpoints.
author: logforce.com
date: 2026/05/02
logsource:
  category: network
  product: lerobot
detection:
  selection:
    DestinationPort: 50051
    Payload|contains:
      - 'c__builtin__'
      - 'ceval'
      - 'cposix'
      - 'system'
  condition: selection
falsepositives:
  - Legitimate pickle payloads (if used insecurely by design)
level: critical

Predictive SIGMA Logic

title: Predictive Detection of LeRobot PolicyServer Anomalies
id: f8a9b0c1-d2e3-4567-8901-67890abcdef1
status: experimental
description: Detects anomalous gRPC traffic or unexpected OS command execution originating from Hugging Face LeRobot PolicyServer.
author: logforce.com
date: 2026/05/02
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: 'policy_server'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/python'
  condition: selection
falsepositives:
  - Legitimate server operations
level: high

LLM Detection Prompt

LLM Prompt: Analyze gRPC traffic targeting Hugging Face LeRobot PolicyServer for suspicious serialized pickle payloads, and monitor host machines for anomalous OS command execution originating from the inference service.

STIX 2.1 Alert

A forecasted alert has been generated for a potential zero-day threat targeting mcp-kubernetes-server, with an estimated peak exploitation date of 2026-04-10. The last critical fix for this vendor was CVE-2025-59377, a critical OS command injection vulnerability in the /mcp/kubectl endpoint where user-supplied input is passed to a shell command with shell=True enabled. It is highly recommended to create a detection token looking for the Potential Detection Tracks to identify early signs of exploitation.

Most Recent Criticality SIGMA Logic

title: Detect mcp-kubernetes-server Command Injection (CVE-2025-59377)
id: a9b0c1d2-e3f4-5678-9012-7890abcdef12
status: experimental
description: Detects shell metacharacters in requests to /mcp/kubectl endpoint.
author: logforce.com
date: 2026/05/02
logsource:
  category: webserver
  product: mcp_kubernetes_server
detection:
  selection:
    uri_path|contains: '/mcp/kubectl'
    uri_query|contains:
      - ';'
      - '|'
      - '&&'
      - '$('
      - '`'
  condition: selection
falsepositives:
  - None expected
level: critical

Predictive SIGMA Logic

title: Predictive Detection of mcp-kubernetes-server Anomalies
id: b0c1d2e3-f4a5-6789-0123-890abcdef123
status: experimental
description: Detects anomalous command chaining or unexpected subprocess execution from mcp-kubernetes-server.
author: logforce.com
date: 2026/05/02
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: 'mcp-kubernetes-server'
    CommandLine|contains:
      - 'curl '
      - 'wget '
      - 'nc '
      - 'bash -i'
  condition: selection
falsepositives:
  - Legitimate kubectl exec commands
level: high

LLM Detection Prompt

LLM Prompt: Monitor mcp-kubernetes-server /mcp/kubectl endpoint requests for suspicious shell metacharacters (e.g., semicolons, pipes), and analyze subprocess execution logs for anomalous command chaining attempts.