Salt Typhoon / Fire Ant TACACS+ Pre-Auth RCE (CVE-2026-48842): OTX Pulse Analysis — Telecom Infrastructure Detection Pack

---
title: Suspicious TACACS+ Traffic from Non-AAA Source
description: Detects TACACS+ (TCP/49) connections originating from hosts that are not authorized network devices or AAA servers — a strong indicator of pre-authentication exploitation attempts against CVE-2026-48842 or lateral movement via compromised AAA infrastructure.
id: 8f3a1c2e-7b4d-4e9a-a1f2-9c6d5e8b7a31
status: experimental
author: Security Arsenal Threat Intel
references:
  - https://news.risky.biz/risky-bulletin-major-vulnerability-found-in-ancient-tacacs-networking-protocol/
date: 2026/09/26
logsource:
  category: network_connection
  product: zeek
  service: conn
detection:
  selection_port:
    id.resp_p: 49
  filter_authorized_sources:
    id.orig_h:
      - '%AAA_SERVER_SUBNET%'
      - '%NETWORK_DEVICE_MGMT_SUBNET%'
  condition: selection_port and not filter_authorized_sources
fields:
  - id.orig_h
  - id.resp_h
  - conn_state
  - orig_bytes
  - resp_bytes
falsepositives:
  - Misconfigured network devices pointing at wrong AAA servers
  - Legacy applications using port 49
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.lateral_movement
  - attack.t1021
  - cve.2026.48842
---
title: TACACS+ Authentication Failure Burst Followed by Success
description: Detects a burst of failed TACACS+ authentications followed by a successful login from the same source — consistent with post-exploitation credential brute-forcing or use of harvested credentials by Salt Typhoon/Fire Ant operators after AAA compromise.
id: 2d7e9f1a-5c3b-48a6-b4e1-1a8c7d6f2e94
status: experimental
author: Security Arsenal Threat Intel
date: 2026/09/26
logsource:
  product: cisco
  service: tacacs
  category: authentication
detection:
  selection_fail:
    - action: 'FAIL'
      status: 'authentication failure'
  timeframe: 10m
  condition: selection_fail | count() by source_ip > 5
falsepositives:
  - Network engineers mistyping enable passwords
  - Automation tools with stale credentials
level: medium
tags:
  - attack.credential_access
  - attack.t1110
  - attack.t1078
---
title: AAA Server Process Spawning Suspicious Child Processes
description: Detects TACACS+ daemon processes (tac_plus, tacacs, ISE runtime) spawning shells, interpreters, or download utilities — a hallmark of successful pre-authentication RCE exploitation on the AAA server.
id: 6b1c4d8e-2f9a-47c5-9d3b-4e7a8f1c5b62
status: experimental
author: Security Arsenal Threat Intel
date: 2026/09/26
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/tac_plus'
      - '/tac_plus.exe'
      - '/tacacs'
      - '/tacacsd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Rare administrative wrappers around tac_plus
level: critical
tags:
  - attack.execution
  - attack.t1059
  - attack.exploitation_for_client_execution
  - cve.2026.48842

// Hunt: TACACS+ (TCP/49) connections from unexpected sources + related process anomalies
// Microsoft Sentinel / Defender XDR — Salt Typhoon / Fire Ant AAA exploitation hunt
let Lookback = 7d;
let AuthorizedAAA = dynamic(["10.10.5.0/24"]); // TODO: replace with your AAA server subnet(s)
let TacacsConnections =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemotePort == 49
    | project TimeGenerated, DeviceName, LocalIP, RemoteIP, RemotePort, InitiatingProcessName, InitiatingProcessCommandLine, InitiatingProcessAccountName;
let SuspiciousSources =
    TacacsConnections
    | where not(ipv4_is_in_range(LocalIP, "10.10.5.0/24")) // adjust: expected client subnets (network devices)
    | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Attempts=count(), Targets=dcount(RemoteIP), TargetList=make_set(RemoteIP) by LocalIP, DeviceName, InitiatingProcessName;
let AAAHostProcessAnomalies =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessName has_any ("tac_plus", "tacacs", "ise")
    | where FileName in~ ("sh", "bash", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "powershell.exe", "cmd.exe")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessName;
union SuspiciousSources, (AAAHostProcessAnomalies | extend LocalIP="", Attempts=long(null), Targets=long(null), TargetList=dynamic(null), FirstSeen=TimeGenerated, LastSeen=TimeGenerated)
| sort by TimeGenerated desc

# Hunt script: TACACS+ AAA server compromise artifacts (CVE-2026-48842)
# Run on TACACS+/AAA servers and management hosts. Exports findings to CSV.
# Security Arsenal — Salt Typhoon / Fire Ant hunt pack — 2026-09-26

$OutFile = "TACACS_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv"
$Findings = @()

Write-Host "[*] Checking for listening TACACS+ services (TCP/49)..." -ForegroundColor Cyan
$TacacsListeners = Get-NetTCPConnection -LocalPort 49 -State Listen -ErrorAction SilentlyContinue
foreach ($conn in $TacacsListeners) {
    $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
    $Findings += [PSCustomObject]@{
        Category = "TACACS+ Listener"
        Detail   = "PID $($conn.OwningProcess) | Process: $($proc.ProcessName) | Path: $($proc.Path) | LocalAddr: $($conn.LocalAddress)"
        Risk     = if ($proc.Path -notmatch "tac|ise|aaa") { "HIGH - unexpected process bound to TCP/49" } else { "INFO" }
    }
}

Write-Host "[*] Checking for rogue local admin accounts (post-exploitation persistence)..." -ForegroundColor Cyan
$RecentAccounts = Get-LocalUser | Where-Object { $_.Enabled -eq $true } | ForEach-Object {
    $created = (Get-LocalUser -Name $_.Name | Select-Object -ExpandProperty PasswordLastSet -ErrorAction SilentlyContinue)
    [PSCustomObject]@{ Name = $_.Name; PasswordSet = $created }
}
foreach ($acct in $RecentAccounts) {
    if ($acct.PasswordSet -and $acct.PasswordSet -gt (Get-Date).AddDays(-14) -and $acct.Name -notmatch "Administrator|DefaultAccount|Guest|WDAG") {
        $Findings += [PSCustomObject]@{ Category = "Suspicious Account"; Detail = "Account '$($acct.Name)' password set $($acct.PasswordSet)"; Risk = "MEDIUM - verify legitimacy" }
    }
}

Write-Host "[*] Checking scheduled tasks for persistence..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.State -ne 'Disabled' } | ForEach-Object {
    $actions = ($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; '
    if ($actions -match "powershell|cmd|curl|wget|certutil|bitsadmin|python|nc\.exe|/bin/") {
        $Findings += [PSCustomObject]@{ Category = "Scheduled Task"; Detail = "$($_.TaskName): $actions"; Risk = "MEDIUM" }
    }
}

Write-Host "[*] Checking recent outbound connections from AAA-related processes..." -ForegroundColor Cyan
$AAAProcs = Get-Process | Where-Object { $_.ProcessName -match "tac|ise|aaa|radius" }
foreach ($p in $AAAProcs) {
    $conns = Get-NetTCPConnection -OwningProcess $p.Id -State Established -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -notmatch "^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|127\.)" }
    foreach ($c in $conns) {
        $Findings += [PSCustomObject]@{ Category = "External Egress"; Detail = "$($p.ProcessName) (PID $($p.Id)) -> $($c.RemoteAddress):$($c.RemotePort)"; Risk = "HIGH - AAA process talking to external IP" }
    }
}

Write-Host "[*] Checking for CVE references in installed patches/versions..." -ForegroundColor Cyan
Write-Host "    Verify against vendor advisories: CVE-2026-48842, CVE-2026-42542, CVE-2026-87902" -ForegroundColor Yellow
$Findings += [PSCustomObject]@{ Category = "Vuln Scope"; Detail = "Manual check required: confirm TACACS+ daemon/ISE version against CVE-2026-48842, CVE-2026-42542, CVE-2026-87902 advisories"; Risk = "ACTION REQUIRED" }

$Findings | Export-Csv -Path $OutFile -NoTypeInformation
Write-Host "[+] Hunt complete. Results written to $OutFile ($($Findings.Count) findings)" -ForegroundColor Green
$Findings | Format-Table -AutoSize