PulseConnectSecure - CVE-2021-22893 Possible Pulse Connect Secure RCE Vulnerability Attack

id: d0c82b7f-40b2-4180-a4d6-7aa0541b7599
name: PulseConnectSecure - CVE-2021-22893 Possible Pulse Connect Secure RCE Vulnerability Attack
description: |
  'This query identifies exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893) to the VPN server'
severity: High
requiredDataConnectors:
  - connectorId: PulseConnectSecure
    dataTypes: 
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess 
relevantTechniques:
  - T1190
query: |
  let threshold = 3;
  PulseConnectSecure
  | where Messages contains "Unauthenticated request url /dana-na/"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Source_IP
  | where count_ > threshold
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: Source_IP
version: 1.0.2
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Sittikorn S
    support:
        tier: Community
    categories:
        domains: [ "Security - Threat Intelligence" ]