PulseConnectSecure - CVE-2021-22893 Possible Pulse Connect Secure RCE Vulnerability Attack

Severity: high
Time window: 1h
Group by: Source_IP
Author: Sittikorn S
Source: github.com/Azure/Azure-Sentinel

'This query identifies exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893) to the VPN server'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Rule body

id: d0c82b7f-40b2-4180-a4d6-7aa0541b7599
name: PulseConnectSecure - CVE-2021-22893 Possible Pulse Connect Secure RCE Vulnerability Attack
description: |
  'This query identifies exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893) to the VPN server'
severity: High
requiredDataConnectors:
  - connectorId: PulseConnectSecure
    dataTypes: 
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess 
relevantTechniques:
  - T1190
query: |
  let threshold = 3;
  PulseConnectSecure
  | where Messages contains "Unauthenticated request url /dana-na/"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Source_IP
  | where count_ > threshold
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: Source_IP
version: 1.0.2
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Sittikorn S
    support:
        tier: Community
    categories:
        domains: [ "Security - Threat Intelligence" ]

Stages and Predicates

Parameters

let threshold = 3;

Stage 1: `source`

PulseConnectSecure

Stage 2: `where`

| where Messages contains "Unauthenticated request url /dana-na/"

Stage 3: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Source_IP

Stage 4: `where`

| where count_ > threshold

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Messages`	contains	`Unauthenticated request url /dana-na/`	`field:"Messages" kind:contains value:"Unauthenticated request url /dana-na/"`
`count_`	gt	`3`	`field:"count_" kind:gt value:"3"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`EndTime`	`summarize`
`Source_IP`	`summarize`
`StartTime`	`summarize`