Emerging Threathightest

Rejetto HTTP File Server RCE

Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Tue Jul 19Updated Mon Jan 02a133193c-2daa-4a29-8022-018695fcf0ae2014

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection_search:
        cs-uri-query|contains: '?search=%00{.'
    selection_payload:
        cs-uri-query|contains:
            - 'save|' # Indication of saving a file which shouldn't be tested by vuln scanners
            - 'powershell'
            - 'cmd.exe'
            - 'cmd /c'
            - 'cmd /r'
            - 'cmd /k'
            - 'cscript'
            - 'wscript'
            - 'python'
            - 'C:\Users\Public\'
            - '%comspec%'
    condition: all of selection_*