Emerging Threathightest

Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877

Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Fri Jan 201b2eeb27-949b-4704-8bfa-d8e5cfa045a12022

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains|all:
            - '/login/index.php'
            - 'login='
        cs-uri-query|contains:
            # TOD: Include other commonly used reverse shells. Examples: https://www.revshells.com/
            - 'login=$('
            # Common keywords related to python reverse shells
            - 'base64'
            - 'subprocess'
            - 'socket'
            - '${IFS}' # Usage of the input field separator to avoid writing spaces
            # B64 Encoded "python" with different offsets
            - 'cHl0aG9u'
            - 'B5dGhvb'
            - 'weXRob2'
    condition: selection