huntrule

Pulse Secure Exploitation Attempt (CVE-2019-11510) via Guacamole URI Pattern

Alerts on web requests with a Guacamole-related URI query pattern associated with a Pulse Secure CVE-2019-11510 exploitation attempt.

FreeUnreviewedSigmacriticalv1
title: Pulse Secure Exploitation Attempt (CVE-2019-11510) via Guacamole URI Pattern
id: a76fb14e-f03b-4ce9-a76f-dc7459a60ac5
status: test
description: This rule flags webserver requests whose URI query matches a pattern containing '/dana/html5acc/guacamole/' and a preceding wildcard. Such requests are consistent with attempts to reach Guacamole-related endpoints used in the context of CVE-2019-11510 exploitation. It relies on HTTP request telemetry that includes the full query string (cs-uri-query) in webserver logs.
references:
  - https://www.exploit-db.com/exploits/47297
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/CVE-2019-11510/web_cve_2019_11510_pulsesecure_exploit.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-11-18
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2019-11510
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query: "*?/dana/html5acc/guacamole/*"
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 2dbc10d7-a797-49a8-8776-49efa6442e60
    type: derived

What it detects

This rule flags webserver requests whose URI query matches a pattern containing '/dana/html5acc/guacamole/' and a preceding wildcard. Such requests are consistent with attempts to reach Guacamole-related endpoints used in the context of CVE-2019-11510 exploitation. It relies on HTTP request telemetry that includes the full query string (cs-uri-query) in webserver logs.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.