deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2023-11-14
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.


Detection logic:
{
  "selection_method": {
    "cs-method": "POST"
  },
  "selection_uris": {
    "cs-uri-query|contains": [
      "/json/setup-restore-local.action",
      "/json/setup-restore-progress.action",
      "/json/setup-restore.action",
      "/server-info.action",
      "/setup/setupadministrator.action"
    ]
  },
  "selection_status": {
    "sc-status": [
      200,
      302,
      405
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server[PII_REDACTED].html
  - https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
  - https://github.com/ForceFledgling/CVE-2023-22518
Sigma Detection Rule: CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2023-11-14
ATT&CK techniques: T1190
Log source: /proxy

Description:
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.


Detection logic:
{
  "selection_method": {
    "cs-method": "POST"
  },
  "selection_uris": {
    "cs-uri|contains": [
      "/json/setup-restore-local.action",
      "/json/setup-restore-progress.action",
      "/json/setup-restore.action",
      "/server-info.action",
      "/setup/setupadministrator.action"
    ]
  },
  "selection_status": {
    "sc-status": [
      200,
      302,
      405
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server[PII_REDACTED].html
  - https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
  - https://github.com/ForceFledgling/CVE-2023-22518
Sigma Detection Rule: CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2023-11-14
ATT&CK techniques: T1059, T1190
Log source: windows/process_creation

Description:
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\tomcat8.exe",
      "\\tomcat9.exe",
      "\\tomcat10.exe"
    ],
    "ParentCommandLine|contains": "confluence"
  },
  "selection_child": [
    {
      "Image|endswith": [
        "\\cmd.exe",
        "\\powershell.exe"
      ]
    },
    {
      "OriginalFileName": [
        "Cmd.Exe",
        "PowerShell.EXE"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server[PII_REDACTED].html
  - https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
  - https://github.com/ForceFledgling/CVE-2023-22518
Sigma Detection Rule: CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2023-11-14
ATT&CK techniques: T1059, T1190
Log source: linux/process_creation

Description:
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "/java",
    "ParentCommandLine|contains": "confluence"
  },
  "selection_child": {
    "Image|endswith": [
      "/bash",
      "/curl",
      "/echo",
      "/wget"
    ]
  },
  "filter_main_ulimit": {
    "CommandLine|contains": "ulimit -u"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server[PII_REDACTED].html
  - https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
  - https://github.com/ForceFledgling/CVE-2023-22518
Sigma Detection Rule: Potential Information Disclosure CVE-2023-43261 Exploitation - Proxy
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo
Date: 2023-10-20
ATT&CK techniques: T1190
Log source: /proxy

Description:
Detects exploitation attempts of CVE-2023-43261 and information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 that allows attackers to access sensitive router components in proxy logs.


Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "c-uri|contains": "/lang/log/httpd.log",
    "sc-status": 200
  },
  "condition": "selection"
}

References:
  - https://thehackernews.com/2023/10/experts-warn-of-severe-flaws-affecting.html
  - https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
  - https://github.com/win3zz/CVE-2023-43261
  - https://vulncheck.com/blog/real-world-cve-2023-43261
Sigma Detection Rule: Potential Information Disclosure CVE-2023-43261 Exploitation - Web
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo
Date: 2023-10-20
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempts of CVE-2023-43261 and information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 that allows attackers to access sensitive router components in access logs.


Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "cs-uri-stem|contains": "/lang/log/httpd.log",
    "sc-status": 200
  },
  "condition": "selection"
}

References:
  - https://thehackernews.com/2023/10/experts-warn-of-severe-flaws-affecting.html
  - https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
  - https://github.com/win3zz/CVE-2023-43261
  - https://vulncheck.com/blog/real-world-cve-2023-43261
Sigma Detection Rule: Exploitation Indicators Of CVE-2023-20198
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Lars B. P. Frydenskov (Trifork Security)
Date: 2023-10-20
Log source: cisco/

Description:
Detecting exploitation indicators of CVE-2023-20198 a privilege escalation vulnerability in Cisco IOS XE Software Web UI.

Detection logic:
{
  "keyword_event": [
    "%WEBUI-6-INSTALL_OPERATION_INFO:",
    "%SYS-5-CONFIG_P:",
    "%SEC_LOGIN-5-WEBLOGIN_SUCCESS:"
  ],
  "keyword_user": [
    "cisco_tac_admin",
    "cisco_support",
    "cisco_sys_manager"
  ],
  "condition": "keyword_event and keyword_user"
}

References:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
  - https://www.thestack.technology/security-experts-call-for-incident-response-exercises-after-mass-cisco-device-exploitation/
Sigma Detection Rule: Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @kostastsale
Date: 2023-06-01
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects the execution of "csc.exe" via "w3wp.exe" process. MOVEit affected hosts execute "csc.exe" via the "w3wp.exe" process to dynamically compile malicious DLL files.

MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\\Windows\\Microsoft\.NET\\Framework64\\v4\.0\.30319\\Temporary ASP\.NET Files\\root\\([a-z0-9]{5,12})\\([a-z0-9]{5,12})\\App_Web_[a-z0-9]{5,12}\.dll.

Hunting Opportunity

Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\w3wp.exe",
    "ParentCommandLine|contains": "moveitdmz pool",
    "Image|endswith": "\\csc.exe"
  },
  "condition": "selection"
}

References:
  - https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
  - https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/
Sigma Detection Rule: Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-01
ATT&CK techniques: T1190
Log source: windows/file_event

Description:
Detects file indicators of potential exploitation of MOVEit CVE-2023-34362.

Detection logic:
{
  "selection_generic": {
    "TargetFilename|contains": [
      "\\MOVEit Transfer\\wwwroot\\",
      "\\MOVEitTransfer\\wwwroot\\"
    ],
    "TargetFilename|endswith": [
      ".7z",
      ".bat",
      ".dll",
      ".exe",
      ".ps1",
      ".rar",
      ".vbe",
      ".vbs",
      ".zip"
    ]
  },
  "selection_known_ioc": {
    "TargetFilename|endswith": [
      "\\MOVEit Transfer\\wwwroot\\_human2.aspx.lnk",
      "\\MOVEit Transfer\\wwwroot\\_human2.aspx",
      "\\MOVEit Transfer\\wwwroot\\human2.aspx.lnk",
      "\\MOVEit Transfer\\wwwroot\\human2.aspx",
      "\\MOVEitTransfer\\wwwroot\\_human2.aspx.lnk",
      "\\MOVEitTransfer\\wwwroot\\_human2.aspx",
      "\\MOVEitTransfer\\wwwroot\\human2.aspx.lnk",
      "\\MOVEitTransfer\\wwwroot\\human2.aspx"
    ]
  },
  "selection_compiled_asp": {
    "CreationUtcTime|startswith": [
      "2023-03- ",
      "2023-04- ",
      "2023-05- ",
      "2023-06- "
    ],
    "TargetFilename|contains|all": [
      "\\Windows\\Microsoft.net\\Framework64\\v",
      "\\Temporary ASP.NET Files\\",
      "App_Web_"
    ],
    "TargetFilename|endswith": ".dll"
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/
  - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
  - https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/
  - https://www.reddit.com/r/sysadmin/comments/13wxuej/comment/jmhdg55/
Sigma Detection Rule: MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-03
ATT&CK techniques: T1505.003
Log source: /webserver

Description:
Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "cs-uri-stem|contains": [
      "/human2.aspx",
      "/_human2.aspx"
    ]
  },
  "condition": "selection"
}

References:
  - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
  - https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft
Sigma Detection Rule: Potential CVE-2023-25157 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-14
Log source: /webserver

Description:
Detects a potential exploitation attempt of CVE-2023-25157 a SQL injection in GeoServer

Detection logic:
{
  "selection_url": {
    "cs-method": "GET",
    "cs-uri-query|contains|all": [
      "/geoserver/ows",
      "CQL_FILTER="
    ],
    "cs-uri-query|contains": [
      "PropertyIsLike",
      "strEndsWith",
      "strStartsWith",
      "FeatureId",
      "jsonArrayContains",
      "DWithin"
    ]
  },
  "selection_payload": {
    "cs-uri-query|contains": [
      "+--",
      "+AS+",
      "+OR+",
      "FROM",
      "ORDER+BY",
      "SELECT",
      "sleep%28",
      "substring%28",
      "UNION",
      "WHERE"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/win3zz/CVE-2023-25157
  - https://twitter.com/parzel2/status/[PII_REDACTED]89915395
  - https://github.com/advisories/GHSA-7g5f-wrx8-5ccf
Sigma Detection Rule: CVE-2023-40477 Potential Exploitation - WinRAR Application Crash
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-31
Log source: windows/

Description:
Detects a crash of "WinRAR.exe" where the version is lower than 6.23. This could indicate potential exploitation of CVE-2023-40477

Detection logic:
{
  "selection": {
    "Provider_Name": "Application Error",
    "EventID": 1000,
    "AppName": "WinRAR.exe"
  },
  "filter_main_fixed_version": {
    "AppVersion|startswith": [
      "6.23.",
      "6.24.",
      "6.25.",
      "6.26.",
      "7."
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://wildptr.io/winrar-cve-2023-40477-poc-new-vulnerability-winrar-security-research/
  - https://github.com/wildptr-io/Winrar-CVE-2023-40477-POC
  - https://www.rarlab.com/vuln_rev3_names.html
Sigma Detection Rule: CVE-2023-40477 Potential Exploitation - .REV File Creation
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-31
Log source: windows/file_event

Description:
Detects the creation of ".rev" files by WinRAR. Could be indicative of potential exploitation of CVE-2023-40477. Look for a suspicious execution shortly after creation or a WinRAR application crash.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\explorer.exe",
      "\\WinRAR.exe"
    ],
    "TargetFilename|endswith": ".rev"
  },
  "condition": "selection"
}

References:
  - https://wildptr.io/winrar-cve-2023-40477-poc-new-vulnerability-winrar-security-research/
  - https://github.com/wildptr-io/Winrar-CVE-2023-40477-POC
  - https://www.rarlab.com/vuln_rev3_names.html
Sigma Detection Rule: Exploitation Attempt Of CVE-2023-46214 Using Public POC Code
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Lars B. P. Frydenskov(Trifork Security)
Date: 2023-11-27
ATT&CK techniques: T1210
Log source: /webserver

Description:
Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code


Detection logic:
{
  "selection_method_and_response": {
    "cs-method": "POST",
    "sc-status": [
      200,
      302
    ]
  },
  "selection_uri_upload": {
    "cs-uri-stem|contains": "/splunkd/__upload/indexing/preview",
    "cs-uri-query|contains|all": [
      "NO_BINARY_CHECK=1",
      "input.path=shell.xsl"
    ]
  },
  "selection_uri_search": {
    "cs-uri-stem|contains|all": [
      "/api/search/jobs",
      "/results"
    ],
    "cs-uri-query|contains|all": [
      "/opt/splunk/var/run/splunk/dispatch/",
      "/shell.xsl"
    ]
  },
  "condition": "selection_method_and_response and 1 of selection_uri_*"
}

References:
  - https://github.com/nathan31337/Splunk-RCE-poc/
  - https://blog.hrncirik.net/cve-2023-46214-analysis
  - https://advisory.splunk.com/advisories/SVD-2023-1104
Sigma Detection Rule: Potential CVE-2023-46214 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Bhavin Patel (STRT)
Date: 2023-11-27
ATT&CK techniques: T1210
Log source: /webserver

Description:
Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing


Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "cs-uri-query|contains|all": [
      "NO_BINARY_CHECK=1",
      "input.path"
    ],
    "cs-uri-query|endswith": ".xsl",
    "sc-status": [
      200,
      302
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/nathan31337/Splunk-RCE-poc/
  - https://blog.hrncirik.net/cve-2023-46214-analysis
  - https://advisory.splunk.com/advisories/SVD-2023-1104
Sigma Detection Rule: Potential CVE-2023-25717 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-30
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "cs-uri-query|contains|all": [
      "/forms/doLogin",
      "login_username",
      "password"
    ],
    "cs-uri-query|contains": [
      "$(",
      "%24%28"
    ]
  },
  "condition": "selection"
}

References:
  - https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/
Sigma Detection Rule: CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io)
Date: 2023-08-30
ATT&CK techniques: T1203
Log source: windows/process_creation

Description:
Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\WinRAR.exe"
  },
  "selection_folder": {
    "CommandLine|contains": "\\AppData\\Local\\Temp\\Rar$"
  },
  "selection_double_ext": {
    "CommandLine|re": "\\.[a-zA-Z0-9]{1,4} \\."
  },
  "selection_binaries": [
    {
      "Image|endswith": [
        "\\cmd.exe",
        "\\cscript.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\wscript.exe"
      ]
    },
    {
      "OriginalFileName": [
        "Cmd.Exe",
        "cscript.exe",
        "PowerShell.EXE",
        "pwsh.dll",
        "wscript.exe"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
  - https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md
Sigma Detection Rule: CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-30
Log source: windows/file_event

Description:
Detects the creation of a file with a double extension and a space by WinRAR. This could be a sign of exploitation of CVE-2023-38331

Detection logic:
{
  "selection": {
    "Image|endswith": "\\WinRAR.exe",
    "TargetFilename|contains": "\\AppData\\Local\\Temp\\Rar$",
    "TargetFilename|re": "\\.[a-zA-Z0-9]{1,4} \\."
  },
  "condition": "selection"
}

References:
  - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
  - https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md
Sigma Detection Rule: Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Gregory
Date: 2023-10-11
ATT&CK techniques: T1505.001
Log source: windows/file_event

Description:
Detects suspicious ".hta" file creation in the startup folder by Foxit Reader. This can be an indication of CVE-2023-27363 exploitation.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\FoxitPDFReader.exe",
    "TargetFilename|contains": "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\",
    "TargetFilename|endswith": ".hta"
  },
  "condition": "selection"
}

References:
  - https://github.com/j00sean/SecBugs/tree/ff72d553f75d93e1a0652830c0f74a71b3f19c46/CVEs/CVE-2023-27363
  - https://www.zerodayinitiative.com/advisories/ZDI-23-491/
  - https://www.tarlogic.com/blog/cve-2023-27363-foxit-reader/
Sigma Detection Rule: Potential CVE-2023-27997 Exploitation Indicators
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sergio Palacios Dominguez, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-28
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects indicators of potential exploitation of CVE-2023-27997 in Frotigate weblogs.
To avoid false positives it is best to look for successive requests to the endpoints mentioned as well as weird values of the "enc" parameter


Detection logic:
{
  "selection_uri": {
    "cs-method": [
      "GET",
      "POST"
    ],
    "cs-uri-query|contains": [
      "/remote/hostcheck_validate",
      "/remote/logincheck"
    ]
  },
  "selection_keywords": [
    "enc="
  ],
  "condition": "all of selection_*"
}

References:
  - https://blog.lexfo.fr/Forensics-xortigate-notice.html
  - https://blog.lexfo.fr/xortigate-cve-2023-27997.html
  - https://research.kudelskisecurity.com/2023/06/12/cve-2023-27997-fortigate-ssl-vpn/
  - https://labs.watchtowr.com/xortigate-or-cve-2023-27997/
Sigma Detection Rule: MSMQ Corrupted Packet Encountered
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-21
Log source: windows/

Description:
Detects corrupted packets sent to the MSMQ service. Could potentially be a sign of CVE-2023-21554 exploitation

Detection logic:
{
  "selection": {
    "Provider_Name": "MSMQ",
    "EventID": 2027,
    "Level": 2
  },
  "condition": "selection"
}

References:
  - https://www.randori.com/blog/vulnerability-analysis-queuejumper-cve-2023-21554/
Sigma Detection Rule: Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-23
Log source: windows/file_event

Description:
Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "\\wermgr.exe"
  },
  "filter_main_locations": {
    "TargetFilename|contains": [
      ":\\$WINDOWS.~BT\\NewOS\\",
      ":\\$WinREAgent\\",
      ":\\Windows\\servicing\\LCU\\",
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\",
      ":\\Windows\\WinSxS\\",
      ":\\WUDownloadCache\\",
      ":\\Windows\\SoftwareDistribution\\Download\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/Wh04m1001/CVE-2023-36874
  - https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
Sigma Detection Rule: Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-23
Log source: windows/file_event

Description:
Detects the creation of a "Report.wer" file in an uncommon folder structure. This could be a sign of potential exploitation of CVE-2023-36874.

Detection logic:
{
  "selection": {
    "TargetFilename|contains": ":\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\",
    "TargetFilename|endswith": "\\Report.wer"
  },
  "filter_main_locations": {
    "TargetFilename|contains": [
      "\\ReportArchive\\AppCrash_",
      "\\ReportArchive\\AppHang_",
      "\\ReportArchive\\Critical_",
      "\\ReportArchive\\Kernel_",
      "\\ReportArchive\\NonCritical_"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/Wh04m1001/CVE-2023-36874
  - https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/