cscli scenarios install crowdsecurity/pulse-secure-sslvpn-cve-2019-115101type: trigger2format: 2.03name: crowdsecurity/pulse-secure-sslvpn-cve-2019-115104description: "Detect cve-2019-11510 exploitation attempts"5filter: |6 evt.Meta.log_type in ["http_access-log", "http_error-log"] and7 (Upper(evt.Meta.http_path) matches Upper('/dana-na/../dana/html5acc/guacamole/../../../../../../../[^?]+\\?/dana/html5acc/guacamole/')8 or9 Upper(evt.Meta.http_path) matches Upper('/dana-na/%2E%2E/dana/html5acc/guacamole/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/[^?]+\\?/dana/html5acc/guacamole/'))10groupby: "evt.Meta.source_ip"11blackhole: 2m12labels:13 remediation: true14 confidence: 315 spoofable: 016 classification:17 - attack.T119018 - cve.CVE-2019-1151019 behavior: "http:exploit"20 label: "Pulse Secure CVE-2019-11510"21 service: pulse-secure22