cscli scenarios install baudneo/zoneminder_cve-2022-392901type: trigger2format: 2.03#debug: true4#/zm/index.php?view=options&tab=users&action=delete&markUids%5B%5D=13&deleteBtn=Delete5name: baudneo/zoneminder_cve-2022-392906description: "Detect cve-2022-39290 exploitation attempts"7filter: |8 evt.Meta.log_type in ["http_access-log", "http_error-log"]9 and Upper(evt.Meta.http_verb) == "GET"10 and Upper(evt.Meta.http_path) matches Upper('.*action=.*')11groupby: "evt.Meta.source_ip"12blackhole: 2m13labels:14 classification:15 - attack.T159516 - attack.T119017 - cve.CVE-2022-3929018 spoofable: 019 confidence: 320 service: zoneminder21 behavior: "http:exploit"22 label: "Zoneminder CVE-2022-39290"23 remediation: true24