Last Week in Threats: Week 38

The Hunting Takeaway

This week's double Cisco vulnerability event creates a clear behavioral hunting target: unauthorized authentication to Cisco Identity Services Engine and anomalous command execution on Secure Email Gateway appliances. Hunt for ISE authentication events where the user or source IP has no prior login history, especially from external or unexpected internal networks. On email gateway appliances, look for AsyncOS process execution outside normal administrative sessions, particularly shell command invocations or unexpected child processes spawned by the email filtering service. Both patterns signal exploitation of CVE-2026-76460 (ISE auth bypass) and CVE-2026-76461 (email gateway SQL injection to root RCE).

Microsoft KQL (Cisco ISE authentication anomaly hunt):

// Hunt for Cisco ISE authentication from previously unseen source IPs
// Requires syslog ingestion from ISE appliances into a Syslog or CommonSecurityLog table
let lookback = 30d;
let recent = 7d;
let knownSources = Syslog
| where TimeGenerated between (ago(lookback) .. ago(recent))
| where SyslogMessage has "CISE" and SyslogMessage has_any ("Passed-Authentication", "authentication succeeded")
| extend SourceIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| where isnotempty(SourceIP)
| distinct SourceIP;
Syslog
| where TimeGenerated > ago(recent)
| where SyslogMessage has "CISE" and SyslogMessage has_any ("Passed-Authentication", "authentication succeeded")
| extend SourceIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| where isnotempty(SourceIP)
| where SourceIP !in (knownSources)
| project TimeGenerated, Computer, SourceIP, SyslogMessage
| order by TimeGenerated desc

Splunk SPL (Cisco Secure Email Gateway command execution anomaly hunt):

index=email sourcetype=cisco:esa
    (process_name=*sh OR process_name=python* OR process_name=perl OR ParentProcessName=*asyncos*)
    earliest=-7d
| eval CommandLine=coalesce(CommandLine, process)
| where isnotnull(CommandLine) AND (like(CommandLine, "%/bin/%") OR like(CommandLine, "%sh -c%") OR like(CommandLine, "%wget%") OR like(CommandLine, "%curl%"))
| stats count min(_time) as FirstSeen max(_time) as LastSeen values(CommandLine) as Commands by host, user, process_name
| convert ctime(FirstSeen) ctime(LastSeen)
| where count < 5
| table FirstSeen, LastSeen, host, user, process_name, Commands, count
| sort -LastSeen

Note: These queries were generated with AI assistance and are a starting point, not a verdict. A query that returns no results does not mean the threat is absent. Confirm that the referenced indexes, sourcetypes, and field names exist in your environment, that the relevant data is actually being ingested, and that names match your schema (watch for spelling and naming drift). Validate against your own ingest and audit trails before drawing conclusions.