Linux_Exploit_CVE_2022_34538_462a8d27

rule Linux_Exploit_CVE_2022_34538_462a8d27 {
    meta:
        author = "Elastic Security"
        id = "462a8d27-4000-4e88-b895-c7d56647908e"
        fingerprint = "d74b6934111bd80dcc473d7d5a0f85a07bef172ba6e021f66fde19510c4b9c3e"
        creation_date = "2022-12-15"
        last_modified = "2026-07-07"
        description = "Exploit code used in the ZeroBot malware"
        threat_name = "Linux.Exploit.CVE-2022-34538"
        reference_sample = "f9fc370955490bdf38fc63ca0540ce1ea6f7eca5123aa4eef730cb618da8551f"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "linux"
    strings:
        $bot_a = "cgi-bin/admin/vca/bia/addacph.cgi?mod&event=a&id=1&pluginname=;"
        $bot_b = ";&name=a&evt_id=a"
    condition:
        all of them
}