1type: trigger
2#debug: true
3name: crowdsecurity/CVE-2022-44877
4description: "Detect CVE-2022-44877 exploits"
5filter: |
6  Lower(evt.Meta.http_path) contains '/index.php' &&
7  Upper(evt.Parsed.verb) == 'POST' &&
8  evt.Meta.http_status == '302' &&
9  Lower(evt.Parsed.http_args) matches 'login=.*[$|%24][\\(|%28].*[\\)|%29]'
10
11blackhole: 1m
12groupby: "evt.Meta.source_ip"
13labels:
14  type: exploit
15  remediation: true
16  classification:
17    - attack.T1595
18    - attack.T1190
19    - cve.CVE-2022-44877
20  spoofable: 0
21  confidence: 3
22  behavior: "http:exploit"
23  label: "Centos Webpanel CVE-2022-44877"
24  service: centos
25