TerraMaster TOS CVE-2020-28188 Web Exploit Attempt via Suspicious makecvs.php GET Requests

title: TerraMaster TOS CVE-2020-28188 Web Exploit Attempt via Suspicious makecvs.php GET Requests
id: ffb5ad72-2239-408a-bbd9-1fc4390a3e67
status: test
description: This rule identifies webserver requests targeting the TerraMaster TOS endpoint /include/makecvs.php with an Event parameter and a query string that includes common attacker tooling and command-style strings. Such patterns are consistent with attempts to trigger the CVE behavior and execute follow-on actions (e.g., downloading and running scripts) through URL parameters. It relies on HTTP webserver logs capturing the full request path and query string, including method and the presence of specific substrings like curl/wget and script/shell markers.
references:
  - https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
  - https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-28188/web_cve_2020_28188_terramaster_rce_exploit.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-01-25
modified: 2023-01-02
tags:
  - attack.t1190
  - attack.initial-access
  - cve.2020-28188
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  base_url:
    cs-method: GET
    cs-uri-query|contains|all:
      - /include/makecvs.php
      - ?Event=
  payload:
    cs-uri-query|contains:
      - curl
      - wget
      - .py
      - .sh
      - chmod
      - _GET
  condition: base_url and payload
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 15c312b9-00d0-4feb-8870-7d940a4bdc5e
    type: derived