SonicWall SSL/VPN Jarrewrite Exploitation
Detects exploitation attempts of the SonicWall Jarrewrite Exploit
Sigma rule (View on GitHub)
1title: SonicWall SSL/VPN Jarrewrite Exploitation
2id: 6f55f047-112b-4101-ad32-43913f52db46
3status: test
4description: Detects exploitation attempts of the SonicWall Jarrewrite Exploit
5references:
6 - https://web.archive.org/web/20210126045316/https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/
7 - https://github.com/darrenmartyn/VisualDoor
8author: Florian Roth (Nextron Systems)
9date: 2021/01/25
10modified: 2023/04/27
11tags:
12 - attack.t1190
13 - attack.initial_access
14 - detection.emerging_threats
15logsource:
16 category: webserver
17detection:
18 selection:
19 cs-uri-query|contains: '/cgi-bin/jarrewrite.sh'
20 cs-user-agent|contains:
21 - ':;'
22 - '() {'
23 - '/bin/bash -c'
24 condition: selection
25fields:
26 - c-ip
27 - c-dns
28falsepositives:
29 - Unknown
30level: high
References
Related rules
- CVE-2010-5278 Exploitation Attempt
- CVE-2020-0688 Exchange Exploitation via Web Log
- CVE-2020-0688 Exploitation Attempt
- CVE-2020-10148 SolarWinds Orion API Auth Bypass
- CVE-2020-5902 F5 BIG-IP Exploitation Attempt