Detect CentOS Web Panel POST login reverse-shell RCE attempts (CVE-2022-44877)
Alert on POST requests to CentOS Web Panel login that contain command-execution and reverse-shell style query parameters.
- Category
- webserver
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-20
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags HTTP POST requests to the CentOS Web Panel login endpoint that include a login parameter containing command/substitution patterns and reverse-shell related strings. Such payloads suggest unauthenticated exploitation attempts aiming to execute attacker-controlled commands on the target. The detection relies on webserver request telemetry, matching the HTTP method and specific substrings in the URL query parameters.
Reporting behind it
- seclists.orghttps://seclists.org/fulldisclosure/2023/Jan/1
- rapid7.comhttps://www.rapid7.com/blog/post/2023/01/19/etr-exploitation-of-control-web-panel-cve-2022-44877/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-44877/web_cve_2022_44877_exploitation_attempt.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Detect CentOS Web Panel POST login reverse-shell RCE attempts (CVE-2022-44877)
id: 5e0ab481-2397-486b-a0a2-bc93151eff65
status: test
description: This rule flags HTTP POST requests to the CentOS Web Panel login endpoint that include a login parameter containing command/substitution patterns and reverse-shell related strings. Such payloads suggest unauthenticated exploitation attempts aiming to execute attacker-controlled commands on the target. The detection relies on webserver request telemetry, matching the HTTP method and specific substrings in the URL query parameters.
references:
- https://seclists.org/fulldisclosure/2023/Jan/1
- https://www.rapid7.com/blog/post/2023/01/19/etr-exploitation-of-control-web-panel-cve-2022-44877/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-44877/web_cve_2022_44877_exploitation_attempt.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-20
tags:
- attack.initial-access
- attack.t1190
- cve.2022-44877
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-query|contains|all:
- /login/index.php
- login=
cs-uri-query|contains:
- login=$(
- base64
- subprocess
- socket
- ${IFS}
- cHl0aG9u
- B5dGhvb
- weXRob2
condition: selection
falsepositives:
- Web vulnerability scanners
level: high
license: DRL-1.1
related:
- id: 1b2eeb27-949b-4704-8bfa-d8e5cfa045a1
type: derived