cscli scenarios install crowdsecurity/CVE-2023-49103Detect exploitation of owncloud CVE-2023-49103
1type: trigger2format: 2.03name: crowdsecurity/CVE-2023-491034description: "Detect owncloud CVE-2023-49103 exploitation attempts"5filter: |6 evt.Meta.log_type in ['http_access-log', 'http_error-log'] && Lower(evt.Meta.http_path) contains '/owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/getphpinfo.php'7groupby: "evt.Meta.source_ip"8blackhole: 2m9labels:10 type: exploit11 remediation: true12 classification:13 - attack.T159514 - attack.T119015 - cve.CVE-2023-4910316 spoofable: 117 confidence: 218 behavior: "http:exploit"19 label: "ownCloud CVE-2023-49103"20 service: owncloud21