Pulse Connect Secure web exploitation attempts matching CVE-2021-22893 URI patterns

title: Pulse Connect Secure web exploitation attempts matching CVE-2021-22893 URI patterns
id: e3a9f80a-e0cd-4b3a-aa61-29ad2b92bfd8
status: stable
description: This rule flags HTTP requests to Pulse Connect Secure that match URI query parameters and paths associated with exploitation attempts related to CVE-2021-22893. Such traffic matters because attackers may use these request patterns to trigger the vulnerable functionality and gain unauthorized access. The detection relies on webserver telemetry, specifically the request URI query string containing the listed path and parameter fragments.
references:
  - https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html
  - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-22893/web_cve_2021_22893_pulse_secure_rce_exploit.yml
author: Sittikorn S, Huntrule Team
date: 2021-06-29
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-22893
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection1:
    cs-uri-query|contains:
      - /dana-na/auth/
      - /dana-ws/
      - /dana-cached/
  selection2:
    cs-uri-query|contains:
      - ?id=
      - ?token=
      - Secid_canceltoken.cgi
      - CGI::param
      - meeting
      - smb
      - namedusers
      - metric
  condition: all of selection*
falsepositives:
  - Vulnerability Scanning
level: high
license: DRL-1.1
related:
  - id: 5525edac-f599-4bfd-b926-3fa69860e766
    type: derived