Emerging Threathightest

TerraMaster TOS CVE-2020-28188

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Bhabesh RajCreated Mon Jan 25Updated Mon Jan 0215c312b9-00d0-4feb-8870-7d940a4bdc5e2020

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    base_url:
        cs-method: 'GET'
        cs-uri-query|contains|all:
            - '/include/makecvs.php'
            - '?Event='
    payload:
        cs-uri-query|contains:
            - 'curl'
            - 'wget'
            - '.py'
            - '.sh'
            - 'chmod'
            - '_GET'
    condition: base_url and payload