1
2name: crowdsecurity/vpatch-CVE-2024-28987
3description: "SolarWinds WHD Hardcoded Credentials (CVE-2024-28987)"
4rules:
5  - and:
6    - zones:
7      - HEADERS
8      variables:
9      - Authorization
10      transform:
11      - b64decode
12      - lowercase
13      match:
14        type: contains
15        value: "helpdeskintegrationuser:dev-c4f8025e7"
16labels:
17  type: exploit
18  service: http
19  confidence: 3
20  spoofable: 0
21  behavior: "http:exploit"
22  label: "SolarWinds WHD - Hardcoded Credentials"
23  classification:
24   - cve.CVE-2024-28987
25   - attack.T1595
26   - attack.T1190
27   - cwe.CWE-798