ADSelfService exploitation attempts via suspicious web URL paths (CVE-2021-40539)

title: ADSelfService exploitation attempts via suspicious web URL paths (CVE-2021-40539)
id: 0ef66e2c-ef4c-4496-b129-9485cdcb101a
status: test
description: This rule matches web requests to specific ADSelfService URL paths associated with exploitation behavior for CVE-2021-40539. Attackers may use these crafted endpoints to reach unauthorized functionality during initial access attempts. The detection relies on webserver telemetry containing request URL query strings that include the listed path patterns.
references:
  - https://us-cert.cisa.gov/ncas/alerts/aa21-259a
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_adselfservice.yml
author: Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems), Huntrule Team
date: 2021-09-20
modified: 2023-01-02
tags:
  - cve.2021-40539
  - detection.emerging-threats
  - attack.initial-access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
      - /help/admin-guide/Reports/ReportGenerate.jsp
      - /ServletApi/../RestApi/LogonCustomization
      - /ServletApi/../RestAPI/Connection
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6702b13c-e421-44cc-ab33-42cc25570f11
    type: derived