detection.wiki

Detection rules › Sigma

Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877

Status
test
Severity
high
Log source
category webserver
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1190 Exploit Public-Facing Application

Rule body yaml

title: Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877
id: 1b2eeb27-949b-4704-8bfa-d8e5cfa045a1
status: test
description: Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877
references:
    - https://seclists.org/fulldisclosure/2023/Jan/1
    - https://www.rapid7.com/blog/post/2023/01/19/etr-exploitation-of-control-web-panel-cve-2022-44877/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-20
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2022-44877
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains|all:
            - '/login/index.php'
            - 'login='
        cs-uri-query|contains:
            # TOD: Include other commonly used reverse shells. Examples: https://www.revshells.com/
            - 'login=$('
            # Common keywords related to python reverse shells
            - 'base64'
            - 'subprocess'
            - 'socket'
            - '${IFS}' # Usage of the input field separator to avoid writing spaces
            # B64 Encoded "python" with different offsets
            - 'cHl0aG9u'
            - 'B5dGhvb'
            - 'weXRob2'
    condition: selection
falsepositives:
    - Web vulnerability scanners
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    cs-method: 'POST'
    cs-uri-query|contains|all:
        - '/login/index.php'
        - 'login='
    cs-uri-query|contains:
        - 'login=$('
        - 'base64'
        - 'subprocess'
        - 'socket'
        - '${IFS}'
        - 'cHl0aG9u'
        - 'B5dGhvb'
        - 'weXRob2'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
cs-methodeq
  • POST
cs-uri-querymatch
  • ${IFS}
  • /login/index.php
  • B5dGhvb
  • base64
  • cHl0aG9u
  • login=
  • login=$(
  • socket
  • subprocess
  • weXRob2