Rejetto HFS exploit attempt: HTTP search query probing for command or script execution

title: "Rejetto HFS exploit attempt: HTTP search query probing for command or script execution"
id: a0b2bca4-1bd1-483c-bb1c-3927b12d2d7e
status: test
description: This rule flags web requests to Rejetto HTTP File Server that include a crafted URI query containing the pattern "?search=%00{." It further matches when the same request includes indicators of file save and command/script execution such as PowerShell, cmd.exe, and script interpreters. Such behavior matters because it aligns with attempts to trigger remote code execution through malicious request parameters. The detection relies on webserver HTTP request telemetry, specifically the contents of the request URI query string.
references:
  - https://vk9-sec.com/hfs-code-execution-cve-2014-6287/
  - https://www.exploit-db.com/exploits/39161
  - https://github.com/Twigonometry/Cybersecurity-Notes/blob/c875b0f52df7d2c7a870e75e1f0c2679d417931d/Writeups/Hack%20the%20Box/Boxes/Optimum/10%20-%20Website.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2014/Exploits/CVE-2014-6287/web_cve_2014_6287_hfs_rce.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-19
modified: 2023-01-02
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1190
  - attack.t1505.003
  - cve.2014-6287
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_search:
    cs-uri-query|contains: ?search=%00{.
  selection_payload:
    cs-uri-query|contains:
      - save|
      - powershell
      - cmd.exe
      - cmd /c
      - cmd /r
      - cmd /k
      - cscript
      - wscript
      - python
      - C:\Users\Public\
      - "%comspec%"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a133193c-2daa-4a29-8022-018695fcf0ae
    type: derived