deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Conti Ransomware Database Dumping Activity Via SQLCmd
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-08-16
ATT&CK techniques: T1005
Log source: windows/process_creation

Description:
Detects a command used by conti to dump database

Detection logic:
{
  "selection_tools": [
    {
      "Image|endswith": "\\sqlcmd.exe"
    },
    {
      "CommandLine|contains": [
        "sqlcmd ",
        "sqlcmd.exe"
      ]
    }
  ],
  "selection_svr": {
    "CommandLine|contains": " -S localhost "
  },
  "selection_query": {
    "CommandLine|contains": [
      "sys.sysprocesses",
      "master.dbo.sysdatabases",
      "BACKUP DATABASE"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/vxunderground/status/[PII_REDACTED]60002816?s=20
  - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection
  - https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-ver15
Sigma Detection Rule: Potential Conti Ransomware Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: frack113
Date: 2021-10-12
ATT&CK techniques: T1486
Log source: windows/process_creation

Description:
Detects a specific command used by the Conti ransomware group

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "-m ",
      "-net ",
      "-size ",
      "-nomutex ",
      "-p \\\\\\\\",
      "$"
    ]
  },
  "condition": "selection"
}

References:
  - https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/
  - https://twitter.com/VK_Intel/status/[PII_REDACTED]00704769?t=Xz7vaLTvaaCZ5kHoZa6gMw&s=19
Sigma Detection Rule: Conti Volume Shadow Listing
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
Date: 2021-08-09
ATT&CK techniques: T1587.001
Log source: windows/process_creation

Description:
Detects a command used by conti to find volume shadow backups

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "vssadmin list shadows",
      "log.txt"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/vxunderground/status/[PII_REDACTED]60002816?s=20
  - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection
Sigma Detection Rule: Conti NTDS Exfiltration Command
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
Date: 2021-08-09
ATT&CK techniques: T1560
Log source: windows/process_creation

Description:
Detects a command used by conti to exfiltrate NTDS

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "7za.exe",
      "\\\\C$\\\\temp\\\\log.zip"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/vxunderground/status/[PII_REDACTED]60002816?s=20
  - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection
Sigma Detection Rule: DarkSide Ransomware Pattern
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-05-14
ATT&CK techniques: T1204
Log source: windows/process_creation

Description:
Detects DarkSide Ransomware and helpers

Detection logic:
{
  "selection1": {
    "CommandLine|contains": [
      "=[char][byte]('0x'+",
      " -work worker0 -path "
    ]
  },
  "selection2": {
    "ParentCommandLine|contains": "DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}",
    "Image|contains": "\\AppData\\Local\\Temp\\"
  },
  "condition": "1 of selection*"
}

References:
  - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
  - https://app.any.run/tasks/8b9a571b-bcc1-4783-ba32-df4ba623b9c0/
  - https://www.joesandbox.com/analysis/411752/0/html#7048BB9A06B8F2DD9D24C77F389D7B2B58D2
Sigma Detection Rule: Moriya Rootkit File Created
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Bhabesh Raj
Date: 2021-05-06
ATT&CK techniques: T1543.003
Log source: windows/file_event

Description:
Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. This filename was reported to be related to the Moriya rootkit as described in the securelist's Operation TunnelSnake report.

Detection logic:
{
  "selection": {
    "TargetFilename": "C:\\Windows\\System32\\drivers\\MoriyaStreamWatchmen.sys"
  },
  "condition": "selection"
}

References:
  - https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831
Sigma Detection Rule: Potential NetWire RAT Activity - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christopher Peacock
Date: 2021-10-07
ATT&CK techniques: T1112
Log source: windows/registry_add

Description:
Detects registry keys related to NetWire RAT

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\software\\NetWire"
  },
  "condition": "selection"
}

References:
  - https://www.fortinet.com/blog/threat-research/new-netwire-rat-variant-spread-by-phishing
  - https://resources.infosecinstitute.com/topic/netwire-malware-what-it-is-how-it-works-and-how-to-prevent-it-malware-spotlight/
  - https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/
  - https://blogs.blackberry.com/en/2021/09/threat-thursday-netwire-rat-is-coming-down-the-line
  - https://app.any.run/tasks/41ecdbde-4997-4301-a[PII_REDACTED]b4c8f/
Sigma Detection Rule: FoggyWeb Backdoor DLL Loading
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-09-27
ATT&CK techniques: T1587
Log source: windows/image_load

Description:
Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. Which loads a malicious version of the expected "version.dll" dll

Detection logic:
{
  "selection": {
    "ImageLoaded": "C:\\Windows\\ADFS\\version.dll"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/
Sigma Detection Rule: Potential CVE-2021-26857 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Bhabesh Raj
Date: 2021-03-03
ATT&CK techniques: T1203
Log source: windows/process_creation

Description:
Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for | abnormal subprocesses spawning by Exchange Server's Unified Messaging service

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\UMWorkerProcess.exe"
  },
  "filter": {
    "Image|endswith": [
      "wermgr.exe",
      "WerFault.exe"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
Sigma Detection Rule: Potential CVE-2021-42287 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-15
ATT&CK techniques: T1558.003
Log source: windows/

Description:
The attacker creates a computer object using those permissions with a password known to her.
After that she clears the attribute ServicePrincipalName on the computer object.
Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.


Detection logic:
{
  "selection": {
    "Provider_Name": "Microsoft-Windows-Directory-Services-SAM",
    "EventID": [
      16990,
      16991
    ]
  },
  "condition": "selection"
}

References:
  - https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/
Sigma Detection Rule: Suspicious Computer Account Name Change CVE-2021-42287
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-12-22
ATT&CK techniques: T1036, T1098
Log source: windows/

Description:
Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287

Detection logic:
{
  "selection": {
    "EventID": 4781,
    "OldTargetUserName|contains": "$"
  },
  "filter": {
    "NewTargetUserName|contains": "$"
  },
  "condition": "selection and not filter"
}

References:
  - https://medium.com/@mvelazco/hunting-for-samaccountname-spoofing-cve-2021-42287-and-domain-controller-impersonation-f704513c8a45
Sigma Detection Rule: Exploitation of CVE-2021-26814 in Wazuh
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-05-22
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects the exploitation of the Wazuh RCE vulnerability described in CVE-2021-26814

Detection logic:
{
  "selection": {
    "cs-uri-query|contains": "/manager/files?path=etc/lists/../../../../.."
  },
  "condition": "selection"
}

References:
  - https://github.com/WickdDavid/CVE-2021-26814/blob/6a17355a10ec4db771d0f112cbe031e418d829d5/PoC.py
Sigma Detection Rule: Potential SystemNightmare Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-08-11
ATT&CK techniques: T1068
Log source: windows/process_creation

Description:
Detects an exploitation attempt of SystemNightmare in order to obtain a shell as LOCAL_SYSTEM

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "printnightmare.gentilkiwi.com",
      " /user:gentilguest ",
      "Kiwi Legit Printer"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/GossiTheDog/SystemNightmare
Sigma Detection Rule: Exchange Exploitation CVE-2021-28480
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-05-14
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects successful exploitation of Exchange vulnerability as reported in CVE-2021-28480

Detection logic:
{
  "selection": {
    "cs-uri-query|contains": "/owa/calendar/a",
    "cs-method": "POST"
  },
  "filter_main_status": {
    "sc-status": 503
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://twitter.com/GossiTheDog/status/[PII_REDACTED]32871683?s=20
Sigma Detection Rule: Potential CVE-2021-42278 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-15
ATT&CK techniques: T1558.003
Log source: windows/

Description:
The attacker creates a computer object using those permissions with a password known to her.
After that she clears the attribute ServicePrincipalName on the computer object.
Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.


Detection logic:
{
  "selection": {
    "Provider_Name": "Microsoft-Windows-Kerberos-Key-Distribution-Center",
    "EventID": [
      35,
      36,
      37,
      38
    ]
  },
  "condition": "selection"
}

References:
  - https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/
Sigma Detection Rule: Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2021-09-08
ATT&CK techniques: T1190, T1059
Log source: windows/process_creation

Description:
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\Atlassian\\Confluence\\jre\\bin\\java.exe",
    "CommandLine|contains": [
      "certutil",
      "cmd /c",
      "cmd /k",
      "cscript",
      "curl",
      "ipconfig",
      "powershell",
      "pwsh",
      "regsvr32",
      "rundll32",
      "whoami",
      "wscript"
    ]
  },
  "condition": "selection"
}

References:
  - https://nvd.nist.gov/vuln/detail/CVE-2021-26084
  - https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25[PII_REDACTED].html
  - https://github.com/h3v0x/CVE-2021-26084_Confluence
Sigma Detection Rule: Potential CVE-2021-26084 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sittikorn S, Nuttakorn T
Date: 2022-12-13
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects potential exploitation of CVE-2021-260841 a Confluence RCE using OGNL injection

Detection logic:
{
  "selection_main": {
    "cs-method": "POST",
    "sc-status": 200,
    "cs-username": "anonymous"
  },
  "selection_exploit_1": {
    "cs-uri-query|contains|all": [
      "/pages/createpage-entervariables.action",
      "SpaceKey=x"
    ]
  },
  "selection_exploit_2_uri": {
    "cs-uri-query|contains": "/doenterpagevariables.action"
  },
  "selection_exploit_2_keyword": [
    "u0027"
  ],
  "condition": "selection_main and (selection_exploit_1 or all of selection_exploit_2_*)"
}

References:
  - https://github.com/TesterCC/exp_poc_library/blob/be61622600ec79d8fba2fa5f816a870715f0cb3b/exp_poc/CVE-2021-26084_Confluence_OGNL_injection/CVE-2021-26084.md
  - https://github.com/httpvoid/writeups/blob/62d[PII_REDACTED]d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md
  - https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25[PII_REDACTED].html
  - https://mraddon.blog/2017/03/20/confluence-trick-to-create-pages-from-blueprint-templates/
Sigma Detection Rule: Grafana Path Traversal Exploitation CVE-2021-43798
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-12-08
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects a successful Grafana path traversal exploitation

Detection logic:
{
  "selection_traversal": {
    "cs-uri-query|contains": "/../../../../../../../",
    "sc-status": 200
  },
  "selection_plugins": {
    "cs-uri-query|contains": [
      "/public/plugins/live",
      "/public/plugins/icon",
      "/public/plugins/loki",
      "/public/plugins/text",
      "/public/plugins/logs",
      "/public/plugins/news",
      "/public/plugins/stat",
      "/public/plugins/mssql",
      "/public/plugins/mixed",
      "/public/plugins/mysql",
      "/public/plugins/tempo",
      "/public/plugins/graph",
      "/public/plugins/gauge",
      "/public/plugins/table",
      "/public/plugins/debug",
      "/public/plugins/zipkin",
      "/public/plugins/jaeger",
      "/public/plugins/geomap",
      "/public/plugins/canvas",
      "/public/plugins/grafana",
      "/public/plugins/welcome",
      "/public/plugins/xychart",
      "/public/plugins/heatmap",
      "/public/plugins/postgres",
      "/public/plugins/testdata",
      "/public/plugins/opentsdb",
      "/public/plugins/influxdb",
      "/public/plugins/barchart",
      "/public/plugins/annolist",
      "/public/plugins/bargauge",
      "/public/plugins/graphite",
      "/public/plugins/dashlist",
      "/public/plugins/piechart",
      "/public/plugins/dashboard",
      "/public/plugins/nodeGraph",
      "/public/plugins/alertlist",
      "/public/plugins/histogram",
      "/public/plugins/table-old",
      "/public/plugins/pluginlist",
      "/public/plugins/timeseries",
      "/public/plugins/cloudw

References:
  - https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/
  - https://github.com/search?q=CVE-2021-43798
Sigma Detection Rule: OMIGOD HTTP No Authentication RCE - CVE-2021-38647
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Nate Guagenti (neu5ron)
Date: 2021-09-20
ATT&CK techniques: T1068, T1190, T1203, T1021.006, T1210
Log source: zeek/

Description:
Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request.
Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP).
Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.


Detection logic:
{
  "selection": {
    "status_code": 200,
    "uri": "/wsman",
    "method": "POST"
  },
  "auth_header": {
    "client_header_names|contains": "AUTHORIZATION"
  },
  "too_small_http_client_body": {
    "request_body_len": 0
  },
  "condition": "selection and not auth_header and not too_small_http_client_body"
}

References:
  - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
  - https://twitter.com/neu5ron/status/[PII_REDACTED]71053057?s=20
Sigma Detection Rule: PwnKit Local Privilege Escalation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sreeman
Date: 2022-01-26
ATT&CK techniques: T1548.001
Log source: linux/

Description:
Detects potential PwnKit exploitation CVE-2021-4034 in auth logs

Detection logic:
{
  "keywords": {
    "|all": [
      "pkexec",
      "The value for environment variable XAUTHORITY contains suspicious content",
      "[USER=root] [TTY=/dev/pts/0]"
    ]
  },
  "condition": "keywords"
}

References:
  - https://twitter.com/wdormann/status/[PII_REDACTED]61579020
Sigma Detection Rule: CVE-2021-33766 Exchange ProxyToken Exploitation
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Christian Burkard (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects the exploitation of Microsoft Exchange ProxyToken vulnerability as described in CVE-2021-33766

Detection logic:
{
  "selection_1": {
    "cs-method": "POST",
    "cs-uri-query|contains|all": [
      "/ecp/",
      "/RulesEditor/InboxRules.svc/NewObject"
    ],
    "sc-status": 500
  },
  "selection_2": {
    "cs-uri-query|contains|all": [
      "SecurityToken=",
      "/ecp/"
    ],
    "sc-status": 500
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server
Sigma Detection Rule: Possible Exploitation of Exchange RCE CVE-2021-42321
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), @testanull
Date: 2021-11-18
ATT&CK techniques: T1210
Log source: windows/

Description:
Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321

Detection logic:
{
  "selection": {
    "EventID": [
      6,
      8
    ],
    "Data|contains": [
      "Cmdlet failed. Cmdlet Get-App, ",
      "Task Get-App throwing unhandled exception: System.InvalidCastException:"
    ]
  },
  "condition": "selection"
}

References:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321
Sigma Detection Rule: ADSelfService Exploitation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems)
Date: 2021-09-20
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539

Detection logic:
{
  "selection": {
    "cs-uri-query|contains": [
      "/help/admin-guide/Reports/ReportGenerate.jsp",
      "/ServletApi/../RestApi/LogonCustomization",
      "/ServletApi/../RestAPI/Connection"
    ]
  },
  "condition": "selection"
}

References:
  - https://us-cert.cisa.gov/ncas/alerts/aa21-259a
Sigma Detection Rule: CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Sittikorn S, Nuttakorn Tungpoonsup
Date: 2021-09-10
ATT&CK techniques: T1190, T1505.003
Log source: /webserver

Description:
Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).

Detection logic:
{
  "selection": {
    "cs-uri-query|contains": [
      "/help/admin-guide/Reports/ReportGenerate.jsp",
      "/RestAPI/LogonCustomization",
      "/RestAPI/Connection"
    ]
  },
  "condition": "selection"
}

References:
  - https://therecord.media/cisa-warns-of-zoho-server-zero-day-exploited-in-the-wild/
  - https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html
  - https://us-cert.cisa.gov/ncas/alerts/aa21-259a
Sigma Detection Rule: CVE-2021-21978 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2020-03-10
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects the exploitation of the VMware View Planner vulnerability described in CVE-2021-21978

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "cs-uri-query|contains|all": [
      "logupload",
      "logMetaData",
      "wsgi_log_upload.py"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/wugeej/status/[PII_REDACTED]55320580
  - https://paper.seebug.org/1495/
Sigma Detection Rule: CVE-2021-41773 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: daffainfo, Florian Roth
Date: 2021-10-05
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation of flaw in path normalization in Apache HTTP server 2.4.49.
An attacker could use a path traversal attack to map URLs to files outside the expected document root.
If files outside of the document root are not protected by "require all denied" these requests can succeed.
Additionally this flaw could leak the source of interpreted files like CGI scripts.
This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.


Detection logic:
{
  "selection": {
    "cs-uri-query|contains": [
      "/cgi-bin/.%2e/",
      "/icons/.%2e/",
      "/cgi-bin/.%%32%65/",
      "/icons/.%%32%65/",
      "/cgi-bin/.%%%25%33",
      "/icons/.%%%25%33"
    ],
    "sc-status": [
      200,
      301
    ]
  },
  "condition": "selection"
}

References:
  - https://nvd.nist.gov/vuln/detail/CVE-2021-41773
  - https://github.com/apache/httpd/commit/e150697086e70c552b2588f369f2d17815cb1782
  - https://twitter.com/ptswarm/status/[PII_REDACTED]48624899
  - https://twitter.com/h4x0r_dz/status/[PII_REDACTED]71429381
  - https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/cves/2021/CVE-2021-41773.yaml
Sigma Detection Rule: SonicWall SSL/VPN Jarrewrite Exploitation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-01-25
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempts of the SonicWall Jarrewrite Exploit

Detection logic:
{
  "selection": {
    "cs-uri-query|contains": "/cgi-bin/jarrewrite.sh",
    "cs-user-agent|contains": [
      ":;",
      "() {",
      "/bin/bash -c"
    ]
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]5316/https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/
  - https://github.com/darrenmartyn/VisualDoor
Sigma Detection Rule: Sitecore Pre-Auth RCE CVE-2021-42237
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-11-17
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempts of Sitecore Experience Platform Pre-Auth RCE CVE-2021-42237 found in Report.ashx

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "cs-uri-query|contains": "/sitecore/shell/ClientBin/Reporting/Report.ashx",
    "sc-status": 200
  },
  "condition": "selection"
}

References:
  - https://blog.assetnote.io/2021/11/02/sitecore-rce/
  - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776