detection.wiki

Detection rules › Sigma

Rejetto HTTP File Server RCE

Status
test
Severity
high
Log source
category webserver
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1190 Exploit Public-Facing Application
PersistenceT1505.003 Server Software Component: Web Shell

Rule body yaml

title: Rejetto HTTP File Server RCE
id: a133193c-2daa-4a29-8022-018695fcf0ae
status: test
description: Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287
references:
    - https://vk9-sec.com/hfs-code-execution-cve-2014-6287/
    - https://www.exploit-db.com/exploits/39161
    - https://github.com/Twigonometry/Cybersecurity-Notes/blob/c875b0f52df7d2c7a870e75e1f0c2679d417931d/Writeups/Hack%20the%20Box/Boxes/Optimum/10%20-%20Website.md
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-19
modified: 2023-01-02
tags:
    - attack.persistence
    - attack.initial-access
    - attack.t1190
    - attack.t1505.003
    - cve.2014-6287
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection_search:
        cs-uri-query|contains: '?search=%00{.'
    selection_payload:
        cs-uri-query|contains:
            - 'save|' # Indication of saving a file which shouldn't be tested by vuln scanners
            - 'powershell'
            - 'cmd.exe'
            - 'cmd /c'
            - 'cmd /r'
            - 'cmd /k'
            - 'cscript'
            - 'wscript'
            - 'python'
            - 'C:\Users\Public\'
            - '%comspec%'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_search

selection_search:
    cs-uri-query|contains: '?search=%00{.'

Stage 2: selection_payload

selection_payload:
    cs-uri-query|contains:
        - 'save|'
        - 'powershell'
        - 'cmd.exe'
        - 'cmd /c'
        - 'cmd /r'
        - 'cmd /k'
        - 'cscript'
        - 'wscript'
        - 'python'
        - 'C:\Users\Public\'
        - '%comspec%'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
cs-uri-querymatch
  • %comspec%
  • ?search=%00{.
  • C:\Users\Public\
  • cmd /c
  • cmd /k
  • cmd /r
  • cmd.exe
  • cscript
  • powershell
  • python
  • save|
  • wscript