Pulse Connect Secure web exploitation attempts for CVE-2021-22893
Detects web requests to Pulse Connect Secure with URI query patterns consistent with CVE-2021-22893 exploitation attempts.
- Category
- webserver
- Author
- Sittikorn S (SigmaHQ), DRL 1.1
- Published
- 2021-06-29
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies likely exploitation activity against Pulse Connect Secure by matching HTTP requests whose query strings include Pulse-specific application paths and RCE-relevant parameter patterns. Attackers may probe or execute the vulnerable functionality by sending crafted requests containing tokens, CGI parameter indicators, and related fields. Telemetry required includes webserver HTTP request metadata, specifically cs-uri-query content in inbound requests.
Reporting behind it
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html
- kb.pulsesecure.nethttps://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-22893/web_cve_2021_22893_pulse_secure_rce_exploit.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Pulse Connect Secure web exploitation attempts for CVE-2021-22893
id: e3a9f80a-e0cd-4b3a-aa61-29ad2b92bfd8
status: stable
description: This rule identifies likely exploitation activity against Pulse Connect Secure by matching HTTP requests whose query strings include Pulse-specific application paths and RCE-relevant parameter patterns. Attackers may probe or execute the vulnerable functionality by sending crafted requests containing tokens, CGI parameter indicators, and related fields. Telemetry required includes webserver HTTP request metadata, specifically cs-uri-query content in inbound requests.
references:
- https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-22893/web_cve_2021_22893_pulse_secure_rce_exploit.yml
author: Sittikorn S, Huntrule Team
date: 2021-06-29
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- cve.2021-22893
- detection.emerging-threats
logsource:
category: webserver
detection:
selection1:
cs-uri-query|contains:
- /dana-na/auth/
- /dana-ws/
- /dana-cached/
selection2:
cs-uri-query|contains:
- ?id=
- ?token=
- Secid_canceltoken.cgi
- CGI::param
- meeting
- smb
- namedusers
- metric
condition: all of selection*
falsepositives:
- Vulnerability Scanning
level: high
license: DRL-1.1
related:
- id: 5525edac-f599-4bfd-b926-3fa69860e766
type: derived