Detects Web exploitation attempts against Cacti remote_agent.php (CVE-2022-46169) on webserver logs

Alert on GET requests to Cacti polldata endpoints containing command-injection payload fragments tied to CVE-2022-46169.

FreeUnreviewedSigmahighv1

detects-web-exploitation-attempts-against-cacti-remote-agent-php-cve-2022-46169--738cb115

title: Detects Web exploitation attempts against Cacti remote_agent.php (CVE-2022-46169) on webserver logs
id: d0ca4cf5-c0c8-4c54-bf3e-0162a45dcf5f
status: test
description: This rule flags HTTP GET requests to /remote_agent.php with action=polldata and a poller_id parameter that also contain command-execution style payload indicators. Such patterns are consistent with exploitation attempts that try to trigger command injection behavior. It relies on webserver telemetry capturing the full URL query string so it can match specific suspicious substrings within cs-uri-query.
references:
  - https://github.com/0xf4n9x/CVE-2022-46169
  - https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf
  - https://github.com/rapid7/metasploit-framework/pull/17407
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-46169/web_cve_2022_46169_cacti_exploitation_attempt.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-27
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2022-46169
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: GET
    cs-uri-query|contains|all:
      - /remote_agent.php
      - action=polldata
      - poller_id=
    cs-uri-query|contains:
      - "| base64 -d | /bin/bash`"
      - "%7C%20base64%20-d%20%7C%20%2Fbin%2Fbash%60"
      - "`whoami"
      - powershell
      - cmd
      - wget
  condition: selection
falsepositives:
  - Web vulnerability scanners
level: high
license: DRL-1.1
related:
  - id: 738cb115-881f-4df3-82cc-56ab02fc5192
    type: derived

What it detects

This rule flags HTTP GET requests to /remote_agent.php with action=polldata and a poller_id parameter that also contain command-execution style payload indicators. Such patterns are consistent with exploitation attempts that try to trigger command injection behavior. It relies on webserver telemetry capturing the full URL query string so it can match specific suspicious substrings within cs-uri-query.

Known false positives

Web vulnerability scanners

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.