Detection rules › Sigma
CVE-2020-10148 SolarWinds Orion API Auth Bypass
Detects CVE-2020-10148 SolarWinds Orion API authentication bypass attempts
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
title: CVE-2020-10148 SolarWinds Orion API Auth Bypass
id: 5a35116f-43bc-4901-b62d-ef131f42a9af
status: test
description: Detects CVE-2020-10148 SolarWinds Orion API authentication bypass attempts
references:
- https://kb.cert.org/vuls/id/843464
author: Bhabesh Raj, Tim Shelton
date: 2020-12-27
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- cve.2020-10148
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- '/WebResource.axd'
- '/ScriptResource.axd'
- '/i18n.ashx'
- '/Skipi18n'
selection2:
cs-uri-query|contains:
- '/SolarWinds/'
- '/api/'
valid_request_1:
cs-uri-query|contains: 'Orion/Skipi18n/Profiler/'
valid_request_2:
cs-uri-query|contains:
- 'css.i18n.ashx'
- 'js.i18n.ashx'
condition: all of selection* and not 1 of valid_request_*
falsepositives:
- Unknown
level: critical
Stages and Predicates
Stage 0: condition
all of selection* and not 1 of valid_request_*Stage 1: selection
selection:
cs-uri-query|contains:
- '/WebResource.axd'
- '/ScriptResource.axd'
- '/i18n.ashx'
- '/Skipi18n'
Stage 2: selection2
selection2:
cs-uri-query|contains:
- '/SolarWinds/'
- '/api/'
Stage 3: not valid_request_*
valid_request_1:
cs-uri-query|contains: 'Orion/Skipi18n/Profiler/'
valid_request_2:
cs-uri-query|contains:
- 'css.i18n.ashx'
- 'js.i18n.ashx'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
cs-uri-query | match | Orion/Skipi18n/Profiler/ | excludes:cs-uri-query field:"cs-uri-query" value:"Orion/Skipi18n/Profiler/" |
cs-uri-query | match | css.i18n.ashx | excludes:cs-uri-query field:"cs-uri-query" value:"css.i18n.ashx" |
cs-uri-query | match | js.i18n.ashx | excludes:cs-uri-query field:"cs-uri-query" value:"js.i18n.ashx" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
cs-uri-query | match |
| field:"cs-uri-query" kind:match |