1type: trigger
2#debug: true
3name: crowdsecurity/CVE-2017-9841
4description: "Detect CVE-2017-9841 exploits"
5filter: |
6    evt.Meta.log_type == 'http_access-log' &&
7    Lower(evt.Meta.http_path) endsWith 'util/php/eval-stdin.php'
8blackhole: 1m
9groupby: "evt.Meta.source_ip"
10labels:
11  type: exploit
12  remediation: true
13  classification:
14    - attack.T1595
15    - attack.T1190
16    - cve.CVE-2017-9841
17  spoofable: 0
18  confidence: 3
19  behavior: "http:exploit"
20  label: "PHP Unit Test Framework CVE-2017-9841"
21  service: PHP
22