Detection rules › Sigma

Pulse Connect Secure RCE Attack CVE-2021-22893

Status
stable
Severity
high
Log source
category webserver
Author
Sittikorn S
Source
github.com/SigmaHQ/sigma

This rule detects exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893)

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1190 Exploit Public-Facing Application

Rule body yaml

title: Pulse Connect Secure RCE Attack CVE-2021-22893
id: 5525edac-f599-4bfd-b926-3fa69860e766
status: stable
description: This rule detects exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893)
references:
    - https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html
    - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784
author: Sittikorn S
date: 2021-06-29
modified: 2023-01-02
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2021-22893
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection1:
        cs-uri-query|contains:
            - '/dana-na/auth/'
            - '/dana-ws/'
            - '/dana-cached/'
    selection2:
        cs-uri-query|contains:
            - '?id='
            - '?token='
            - 'Secid_canceltoken.cgi'
            - 'CGI::param'
            - 'meeting'
            - 'smb'
            - 'namedusers'
            - 'metric'
    condition: all of selection*
falsepositives:
    - Vulnerability Scanning
level: high

Stages and Predicates

Stage 0: condition

all of selection*

Stage 1: selection1

selection1:
    cs-uri-query|contains:
        - '/dana-na/auth/'
        - '/dana-ws/'
        - '/dana-cached/'

Stage 2: selection2

selection2:
    cs-uri-query|contains:
        - '?id='
        - '?token='
        - 'Secid_canceltoken.cgi'
        - 'CGI::param'
        - 'meeting'
        - 'smb'
        - 'namedusers'
        - 'metric'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
cs-uri-querymatch
  • /dana-cached/
  • /dana-na/auth/
  • /dana-ws/
  • ?id=
  • ?token=
  • CGI::param
  • Secid_canceltoken.cgi
  • meeting
  • metric
  • namedusers
  • smb