ADSelfService Exploitation

testhigh
log source: webserverauthor Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems)date 2021-09-20
01

description

What this is, in brief.

Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539

02

tags

cve.2021-40539detection.emerging-threatsattack.initial-accessattack.t1190
03

rule source (YAML)

title: ADSelfService Exploitation
id: 6702b13c-e421-44cc-ab33-42cc25570f11
status: test
description: Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539
references:
    - https://us-cert.cisa.gov/ncas/alerts/aa21-259a
author: Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems)
date: 2021-09-20
modified: 2023-01-02
tags:
    - cve.2021-40539
    - detection.emerging-threats
    - attack.initial-access
    - attack.t1190
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '/help/admin-guide/Reports/ReportGenerate.jsp'
            - '/ServletApi/../RestApi/LogonCustomization'
            - '/ServletApi/../RestAPI/Connection'
    condition: selection
falsepositives:
    - Unknown
level: high
04

detects techniques (1)

ATT&CK techniques this enables or maps to.

05

references

External citations — patches, advisories, analysis.