ET WEB_SPECIFIC_APPS DNN DNNPersonalization Cookie RCE Attempt (CVE-2017-9822)

Query · suricata

flow:established,to_server;
http.cookie;
content:"DNNPersonalization="; fast_pattern;
content:"ObjectStateFormatter";
content:"ObjectDataProvider";
Raw source ET WEB_SPECIFIC_APPS DNN DNNPersonalization Cookie RCE Attempt (CVE-2017-9822) · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http any any -> $HTTP_SERVERS any (
    msg:"ET WEB_SPECIFIC_APPS DNN DNNPersonalization Cookie RCE Attempt (CVE-2017-9822)";
    flow:established,to_server;
    http.cookie;
    content:"DNNPersonalization="; fast_pattern;
    content:"ObjectStateFormatter";
    content:"ObjectDataProvider";
    reference:cve,2017-9822;
    reference:url,f5.com/labs/articles/threat-intelligence/cyber-security/zealot-new-apache-struts-campaign-uses-eternalblue-and-eternalsynergy-to-mine-monero-on-internal-networks?sf176487178;
    classtype:attempted-admin;
    sid:2025545; rev:4;
    metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_04_27, cve CVE_2017_9822, deployment Datacenter, signature_severity Minor, tag CISA_KEV, updated_at 2020_11_04;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.