cscli scenarios install crowdsecurity/CVE-2022-416971type: leaky2name: crowdsecurity/CVE-2022-416973description: "Detect CVE-2022-41697 enumeration"4filter: |5 Upper(evt.Meta.http_path) contains Upper('/ghost/api/admin/session') &&6 Upper(evt.Parsed.verb) == 'POST' &&7 evt.Meta.http_status == '404'8leakspeed: "10s"9capacity: 510blackhole: 1m11groupby: "evt.Meta.source_ip"12labels:13 type: exploit14 remediation: true15 classification:16 - attack.T158917 - cve.CVE-2022-4169718 spoofable: 019 confidence: 320 behavior: "http:exploit"21 label: "Ghost CVE-2022-41697"22 service: ghost23