Emerging Threathightest

ADSelfService Exploitation

Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Tobias Michalski, Max Altgelt (Nextron Systems)Created Mon Sep 20Updated Mon Jan 026702b13c-e421-44cc-ab33-42cc25570f112021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection:
        cs-uri-query|contains:
            - '/help/admin-guide/Reports/ReportGenerate.jsp'
            - '/ServletApi/../RestApi/LogonCustomization'
            - '/ServletApi/../RestAPI/Connection'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

Resolving title…

us-cert.cisa.gov

MITRE ATT&CK

Tactics

TA0001 · Initial Access

Techniques

T1190 · Exploit Public-Facing Application

Other