1type: leaky
2name: crowdsecurity/CVE-2022-46169-bf
3description: "Detect CVE-2022-46169 brute forcing"
4filter: |
5  Upper(evt.Meta.http_path) contains Upper('/remote_agent.php') &&
6  Upper(evt.Parsed.verb) == 'GET' &&
7  Lower(evt.Parsed.http_args) contains 'host_id' &&
8  Lower(evt.Parsed.http_args) contains 'local_data_ids'
9leakspeed: "10s"
10capacity: 5
11blackhole: 1m
12groupby: "evt.Meta.source_ip"
13labels:
14  type: exploit
15  remediation: true
16  classification:
17    - attack.T1592
18    - cve.CVE-2022-46169
19  spoofable: 0
20  confidence: 3
21  behavior: "http:bruteforce"
22  label: "Cacti CVE-2022-46169"
23  service: cacti
24---
25type: trigger
26name: crowdsecurity/CVE-2022-46169-cmd
27description: "Detect CVE-2022-46169 cmd injection"
28filter: |
29  Upper(evt.Meta.http_path) contains Upper('/remote_agent.php') &&
30  Upper(evt.Parsed.verb) == 'GET' &&
31  Lower(evt.Parsed.http_args) contains 'action=polldata' &&
32  Lower(evt.Parsed.http_args) matches 'poller_id=.*(;|%3b)'
33blackhole: 1m
34groupby: "evt.Meta.source_ip"
35labels:
36  type: exploit
37  remediation: true
38  classification:
39    - attack.T1595
40    - attack.T1190
41    - cve.CVE-2022-46169
42  spoofable: 0
43  confidence: 3
44  behavior: "http:exploit"
45  label: "Cacti CVE-2022-46169"
46  service: cacti
47