cscli scenarios install crowdsecurity/CVE-2022-42889Detects attempts of exploit of CVE-2022-42889 (Text4Shell) RCE vulnerability.
Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42889
1type: trigger2#debug: true3name: crowdsecurity/CVE-2022-428894description: "Detect CVE-2022-42889 exploits (Text4Shell)"5filter: |6 Upper(PathUnescape(evt.Meta.http_path)) contains Upper('${script:javascript:java.lang.Runtime.getRuntime().exec(')7 or8 Upper(PathUnescape(evt.Meta.http_path)) contains Upper('${script:js:java.lang.Runtime.getRuntime().exec(')9 or10 Upper(PathUnescape(evt.Meta.http_path)) contains Upper('${url:UTF-8:')11 or12 Upper(PathUnescape(evt.Meta.http_path)) contains Upper('${dns:address|')13blackhole: 1m14groupby: "evt.Meta.source_ip"15labels:16 type: exploit17 remediation: true18 classification:19 - attack.T159520 - attack.T119021 - cve.CVE-2022-4288922 spoofable: 023 confidence: 324 behavior: "http:exploit"25 label: "Text4Shell CVE-2022-42889"26 service: apache27