1type: trigger
2format: 2.0
3name: crowdsecurity/CVE-2024-9474
4description: "Detect CVE-2024-9474 exploitation attempts"
5filter: |
6  let request = Lower(evt.Parsed.request);
7  evt.Meta.log_type in ['http_access-log', 'http_error-log'] && 
8  evt.Meta.http_status in ['404', '403'] &&
9  evt.Meta.http_verb == 'POST' &&
10  request contains '/php/utils/createremoteappwebsession.php/watchtowr.js.map'
11groupby: "evt.Meta.source_ip"
12blackhole: 2m
13labels:
14  type: exploit
15  remediation: true
16  classification:
17    - attack.T1595
18    - attack.T1190
19    - cve.CVE-2024-9474
20  confidence: 3
21  spoofable: 0
22  behavior: "http:exploit"
23  label: "CVE-2024-9474"
24  service: panos
25