Hub configuration

Name: ownCloud CVE-2023-49103
Author: crowdsecurity

More info

ownCloud CVE-2023-49103 Detection Scenario by crowdsecurity | CrowdSec Hub

« ownCloud CVE-2023-49103 »
v0.3 by crowdsecurity / CVE-2023-49103
Attack scenarioowncloudRarely spoofableMedium confidence

Detect owncloud CVE-2023-49103 exploitation attempts

Installation

cscli scenarios install crowdsecurity/CVE-2023-49103

Description

Detect exploitation of owncloud CVE-2023-49103

Ref: https://nvd.nist.gov/vuln/detail/CVE-2023-49103

YAML Configuration

1type: trigger
2format: 2.0
3name: crowdsecurity/CVE-2023-49103
4description: "Detect owncloud CVE-2023-49103 exploitation attempts"
5filter: |
6  evt.Meta.log_type in ['http_access-log', 'http_error-log'] && Lower(evt.Meta.http_path) contains '/owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/getphpinfo.php'
7groupby: "evt.Meta.source_ip"
8blackhole: 2m
9labels:
10  type: exploit
11  remediation: true
12  classification:
13    - attack.T1595
14    - attack.T1190
15    - cve.CVE-2023-49103
16  spoofable: 1
17  confidence: 2
18  behavior: "http:exploit"
19  label: "ownCloud CVE-2023-49103"
20  service: owncloud
21

Hub configuration

« ownCloud CVE-2023-49103 »v0.3 by crowdsecurity / CVE-2023-49103Attack scenarioCVE-2023-49103ownCloudowncloudRarely spoofableMedium confidenceMITRE:T1595MITRE:T1190

« ownCloud CVE-2023-49103 »
v0.3 by crowdsecurity / CVE-2023-49103
Attack scenarioowncloudRarely spoofableMedium confidence