Zoho ManageEngine ADSelfService Plus CVE-2021-40539 REST API exploit URL access (Web)

Flags web requests targeting ADSelfService Plus REST API paths linked to CVE-2021-40539 authentication bypass.

FreeReviewedSigma · Critical · v5
Category
webserver
Author
Sittikorn S, Nuttakorn Tungpoonsup (SigmaHQ), DRL 1.1
Published
2021-09-10
Updated
2026-07-31

ATT&CK techniques

Initial Access → Persistence
  1. Recon

  2. Resource Dev

  3. Execution

  4. Priv Esc

  5. Defense Evasion

  6. Cred Access

  7. Discovery

  8. Lateral Movement

  9. Collection

  10. C2

  11. Exfiltration

  12. Impact

What it detects

This rule flags web requests whose URI query contains specific paths associated with the ADSelfService Plus REST API authentication bypass (CVE-2021-40539). Attackers may use these endpoints to gain unauthorized access, enabling follow-on intrusion and persistence. The detection relies on webserver telemetry that records the full request URI query, matching the presence of the targeted substrings.

Related detections9 linkedT1190 — drag to rearrange
Malicious IIS Worker Process Spawning Command Shell Reconnaissance
Possible Citrix ShareFile Unauthenticated Upload Path Traversal Webshell (CVE-2023-24489) (via webserver)
Possible Unauthenticated Admin Creation in Dynamicweb CVE-2022-25369
Possible DotCMS Path Traversal Webshell Upload via content API CVE-2022-26352
Possible Avaya Aura Device Services WebDAV PHP Webshell Upload via PhoneBackup (via webserver)
Possible DotCMS Arbitrary File Upload and JSP Webshell Drop via api content (via webserver)
Malicious Dynamicweb Unauthenticated Administrator Creation via Setup Default.aspx (via webserver)
Possible PHP Webshell Access After Malicious ZIP Upload (via webserver)
Possible Oracle Opera CGI Webshell Command Execution via operabin
Zoho ManageEngine ADSelfService Plus CVE-2021-40539 REST API exploit URL access (Web)
Pivot detection · T1190 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.