cscli scenarios install crowdsecurity/CVE-2022-44877Trigger exploits of CVE-2022-44877 Centos Web Panel 7 Unauthenticated Remote Code Execution
1type: trigger2#debug: true3name: crowdsecurity/CVE-2022-448774description: "Detect CVE-2022-44877 exploits"5filter: |6 Lower(evt.Meta.http_path) contains '/index.php' &&7 Upper(evt.Parsed.verb) == 'POST' &&8 evt.Meta.http_status == '302' &&9 Lower(evt.Parsed.http_args) matches 'login=.*(\\$|%24)(\\(|%28).*(\\)|%29)'1011blackhole: 1m12groupby: "evt.Meta.source_ip"13labels:14 type: exploit15 remediation: true16 classification:17 - attack.T159518 - attack.T119019 - cve.CVE-2022-4487720 spoofable: 021 confidence: 322 behavior: "http:exploit"23 label: "Centos Webpanel CVE-2022-44877"24 service: centos25