detection.wiki

Detection rules › Sigma

MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request

Status
test
Severity
high
Log source
category webserver
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

Known false positives

  • Unlikely

MITRE ATT&CK coverage

TacticTechniques
Persistence

Rule body

title: MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request
id: 435e41f2-48eb-4c95-8a2b-ed24b50ec30b
status: test
description: Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362
references:
    - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
    - https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-03
modified: 2023-07-28
tags:
    - attack.persistence
    - attack.t1505.003
    - cve.2023-34362
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains:
            - '/human2.aspx'
            - '/_human2.aspx'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    cs-method: 'GET'
    cs-uri-stem|contains:
        - '/human2.aspx'
        - '/_human2.aspx'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
cs-methodeq
  • GET
field:"cs-method" kind:eq value:"GET"
cs-uri-stemmatch
  • /_human2.aspx
  • /human2.aspx
field:"cs-uri-stem" kind:match