1name: crowdsecurity/vpatch-CVE-2017-9841
2description: "PHPUnit RCE (CVE-2017-9841)"
3rules:
4  - and:
5    - zones:
6      - URI
7      transform:
8      - lowercase
9      match:
10        type: endsWith
11        value: /util/php/eval-stdin.php
12labels:
13  type: exploit
14  service: http
15  confidence: 3
16  spoofable: 0
17  behavior: "http:exploit"
18  label: "PHPUnit RCE"
19  classification:
20   - cve.CVE-2017-9841
21   - attack.T1595
22   - attack.T1190
23   - cwe.CWE-94