CVE-2022-22965 Network Activity

Description

The following query surface network activity associated with exploitation of CVE-2022-22965.

Query · kql

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType =~ "NetworkSignatureInspected"
| where AdditionalFields contains ".jsp?cmd="
| summarize makeset(AdditionalFields, 5), min(Timestamp), max(Timestamp) by DeviceId, DeviceName
Raw source CVE-2022-22965 Network Activity · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 98b496c6-da2e-4b03-8e38-c038b2e3062d
name: CVE-2022-22965 Network Activity
description: |
  The following query surface network activity associated with exploitation of CVE-2022-22965.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
tactics:
- Privilege escalation
- Exploit
query: |   
  DeviceNetworkEvents
  | where Timestamp > ago(7d)
  | where ActionType =~ "NetworkSignatureInspected"
  | where AdditionalFields contains ".jsp?cmd="
  | summarize makeset(AdditionalFields, 5), min(Timestamp), max(Timestamp) by DeviceId, DeviceName

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.