Pulse Connect Secure RCE Attack CVE-2021-22893

Description

This rule detects exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893)

Query · sigma

selection1:
  cs-uri-query|contains:
  - /dana-na/auth/
  - /dana-ws/
  - /dana-cached/
selection2:
  cs-uri-query|contains:
  - ?id=
  - ?token=
  - Secid_canceltoken.cgi
  - CGI::param
  - meeting
  - smb
  - namedusers
  - metric
condition: all of selection*

Known false positives

  • Vulnerability Scanning
Raw source Pulse Connect Secure RCE Attack CVE-2021-22893 · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Pulse Connect Secure RCE Attack CVE-2021-22893
id: 5525edac-f599-4bfd-b926-3fa69860e766
status: stable
description: This rule detects exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893)
references:
    - https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html
    - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784
author: Sittikorn S
date: 2021-06-29
modified: 2023-01-02
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2021-22893
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection1:
        cs-uri-query|contains:
            - '/dana-na/auth/'
            - '/dana-ws/'
            - '/dana-cached/'
    selection2:
        cs-uri-query|contains:
            - '?id='
            - '?token='
            - 'Secid_canceltoken.cgi'
            - 'CGI::param'
            - 'meeting'
            - 'smb'
            - 'namedusers'
            - 'metric'
    condition: all of selection*
falsepositives:
    - Vulnerability Scanning
level: high

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.