Jira CVE-2021-26086 exploitation Detection Scenario by crowdsecurity | CrowdSec Hub

Jira CVE-2021-26086 exploitation

Attack scenariohttp:exploitMITRE T1595.001MITRE T1190cve.CVE-2021-26086

By: crowdsecurity
Version: 0.4
Name: crowdsecurity/jira_cve-2021-26086
Remediation: Ban

Detect Atlassian Jira CVE-2021-26086 exploitation attempts

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/whm

Installs 18 parsers and 66 scenarios, via HTTP - CVE Detection.

View WHM →

Installation

sudo cscli scenarios install crowdsecurity/jira_cve-2021-26086

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/jira_cve-2021-26086.yaml· 24 linesGitHub

1type: trigger1
2format: 2.0
3#debug: true
4name: crowdsecurity/jira_cve-2021-26086
5description: "Detect Atlassian Jira CVE-2021-26086 exploitation attempts"
6filter: |2
7  evt.Meta.log_type in ["http_access-log", "http_error-log"] and any(File("jira_cve_2021-26086.txt"), {Upper(evt.Meta.http_path) contains Upper(#)})
8data:
9  - source_url: https://hub-data.crowdsec.net/web/jira_cve_2021-26086.txt
10    dest_file: jira_cve_2021-26086.txt
11    type: string
12groupby: "evt.Meta.source_ip"3
13blackhole: 2m4
14labels:
15  remediation: true5
16  classification:6
17    - attack.T1595.001
18    - attack.T1190
19    - cve.CVE-2021-26086
20  behavior: "http:exploit"
21  label: "Jira CVE-2021-26086 exploitation"
22  spoofable: 0
23  service: jira
24  confidence: 3

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.