Telerik CVE-2019-18935 Detection Scenario by crowdsecurity | CrowdSec Hub

Telerik CVE-2019-18935

Attack scenariohttp:exploitMITRE T1595MITRE T1190cve.CVE-2019-18935

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/CVE-2019-18935
Remediation: Ban

Detect Telerik CVE-2019-18935 exploitation attempts

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/whm

Installs 18 parsers and 66 scenarios, via HTTP - CVE Detection.

View WHM →

Installation

sudo cscli scenarios install crowdsecurity/CVE-2019-18935

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/CVE-2019-18935.yaml· 20 linesGitHub

1type: trigger1
2format: 2.0
3name: crowdsecurity/CVE-2019-18935
4description: "Detect Telerik CVE-2019-18935 exploitation attempts"
5filter: |2
6  evt.Meta.log_type in ['http_access-log', 'http_error-log'] && Upper(QueryUnescape(evt.Meta.http_path)) startsWith Upper('/Telerik.Web.UI.WebResource.axd?type=rau')
7groupby: "evt.Meta.source_ip"3
8blackhole: 2m4
9labels:
10  type: exploit
11  remediation: true5
12  classification:6
13    - attack.T1595
14    - attack.T1190
15    - cve.CVE-2019-18935
16  spoofable: 0
17  confidence: 3
18  behavior: "http:exploit"
19  label: "Telerik CVE-2019-18935"
20  service: telerik

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect exploitation of Telerik CVE-2019-18935

Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18935 Poc: https://github.com/noperator/CVE-2019-18935