SonicWall SSL VPN Jarrewrite Exploit Attempts via Suspicious HTTP Query and User-Agent

title: SonicWall SSL VPN Jarrewrite Exploit Attempts via Suspicious HTTP Query and User-Agent
id: 99987df5-daa9-418e-8caa-f29a494fbc1e
status: test
description: This rule identifies likely exploitation activity targeting SonicWall SSL VPN by matching HTTP requests that include the /cgi-bin/jarrewrite.sh path and user-agent strings containing common command-injection patterns. Attackers use these probes to trigger server-side script execution or command injection as part of initial compromise. Detection relies on webserver telemetry capturing the HTTP URI query and user-agent fields for each request.
references:
  - https://web.archive.org/web/20210126045316/https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/
  - https://github.com/darrenmartyn/VisualDoor
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/VisualDoor-Exploit/web_sonicwall_jarrewrite_exploit.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-01-25
modified: 2023-04-27
tags:
  - attack.t1190
  - attack.initial-access
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains: /cgi-bin/jarrewrite.sh
    cs-user-agent|contains:
      - :;
      - () {
      - /bin/bash -c
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6f55f047-112b-4101-ad32-43913f52db46
    type: derived