Webserver CVE-2019-11510 Exploitation Attempt via Guacamole URI

Alerts on web requests with a Guacamole-related URI query pattern associated with a Pulse Secure CVE-2019-11510 exploitation attempt.

FreeReviewedSigma · Critical · v5

Category: webserver
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2019-11-18
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies web requests whose URI query contains a pattern targeting the Guacamole path associated with CVE-2019-11510. Attackers may use crafted requests to reach vulnerable Pulse Secure components and attempt initial access. The detection relies on webserver request telemetry, specifically the captured request URI query string.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious SharePoint ToolShell Exploitation via ToolPane Endpoint

Malicious Exchange Mailbox Export to ASPX via New-MailboxExportRequest

Suspicious Shell Spawned by ActiveMQ Java Process

Cleo Autorun Exploitation via Healthcheck File Drop

Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell

Malicious IIS Worker Process Spawning Command Shell Reconnaissance

Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)

Cisco IOS XE Configuration Change by Web UI WSMA User

Possible React2Shell CVE-2025-55182 Prototype Pollution Exploitation

Webserver CVE-2019-11510 Exploitation Attempt via Guacamole URI

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

pulse-secure-exploitation-attempt-cve-2019-11510-via-guacamole-uri-pattern-2dbc10d7

title: Webserver CVE-2019-11510 Exploitation Attempt via Guacamole URI
id: a76fb14e-f03b-4ce9-a76f-dc7459a60ac5
status: test
description: This rule identifies web requests whose URI query contains a pattern targeting the Guacamole path associated with CVE-2019-11510. Attackers may use crafted requests to reach vulnerable Pulse Secure components and attempt initial access. The detection relies on webserver request telemetry, specifically the captured request URI query string.
references:
  - https://www.exploit-db.com/exploits/47297
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/CVE-2019-11510/web_cve_2019_11510_pulsesecure_exploit.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-11-18
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2019-11510
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query: "*?/dana/html5acc/guacamole/*"
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 2dbc10d7-a797-49a8-8776-49efa6442e60
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL