detection.wiki

Detection rules › Sigma

Potential CVE-2022-46169 Exploitation Attempt

Status
test
Severity
high
Log source
category webserver
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1190 Exploit Public-Facing Application

Rule body yaml

title: Potential CVE-2022-46169 Exploitation Attempt
id: 738cb115-881f-4df3-82cc-56ab02fc5192
status: test
description: Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169
references:
    - https://github.com/0xf4n9x/CVE-2022-46169
    - https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf
    - https://github.com/rapid7/metasploit-framework/pull/17407
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-27
modified: 2023-01-02
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2022-46169
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        # Check for the presence of the X-FORWARDED-FOR header pointing to the hostname of the server running Cacti (which indicate auth bypass)
        # Check for previous requests indicating the bruteforce of the "local_data_ids" and "host_id"
        cs-method: 'GET'
        cs-uri-query|contains|all:
            - '/remote_agent.php'
            - 'action=polldata'
            - 'poller_id='
        cs-uri-query|contains:
            # From https://github.com/rapid7/metasploit-framework/pull/17407/files#diff-972a47250ccd30b935a59e8871134956a15980df5b29f9d970414646704d5258R288
            # Not tested could be shown in other format (update if you have more info)
            - '| base64 -d | /bin/bash`'
            - '%7C%20base64%20-d%20%7C%20%2Fbin%2Fbash%60' # URL encoded version
            # Add more suspicious commands accordingly
            - '`whoami'
            - 'powershell'
            - 'cmd'
            - 'wget'
    condition: selection
falsepositives:
    - Web vulnerability scanners
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    cs-method: 'GET'
    cs-uri-query|contains|all:
        - '/remote_agent.php'
        - 'action=polldata'
        - 'poller_id='
    cs-uri-query|contains:
        - '| base64 -d | /bin/bash`'
        - '%7C%20base64%20-d%20%7C%20%2Fbin%2Fbash%60'
        - '`whoami'
        - 'powershell'
        - 'cmd'
        - 'wget'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
cs-methodeq
  • GET
cs-uri-querymatch
  • %7C%20base64%20-d%20%7C%20%2Fbin%2Fbash%60
  • /remote_agent.php
  • `whoami
  • action=polldata
  • cmd
  • poller_id=
  • powershell
  • wget
  • | base64 -d | /bin/bash`