ADSelfService Exploitation

testhigh
Log-Quelle: webserverAutor Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems)Datum 2021-09-20
01

Beschreibung

Was dies ist, in Kürze.

Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539

02

Tags

cve.2021-40539detection.emerging-threatsattack.initial-accessattack.t1190
03

Regelquelle (YAML)

title: ADSelfService Exploitation
id: 6702b13c-e421-44cc-ab33-42cc25570f11
status: test
description: Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539
references:
    - https://us-cert.cisa.gov/ncas/alerts/aa21-259a
author: Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems)
date: 2021-09-20
modified: 2023-01-02
tags:
    - cve.2021-40539
    - detection.emerging-threats
    - attack.initial-access
    - attack.t1190
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '/help/admin-guide/Reports/ReportGenerate.jsp'
            - '/ServletApi/../RestApi/LogonCustomization'
            - '/ServletApi/../RestAPI/Connection'
    condition: selection
falsepositives:
    - Unknown
level: high
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.