valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix cs-uri-query and cs-uri-stem

Browse Source
This commit is contained in:
frack113 2021-08-11 15:09:53 +02:00 committed by GitHub
parent ff5c9116a4
commit 32fc191163
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
rules/web/web_cve_2021_26858_iis_rce.yml
View File

@ -14,8 +14,8 @@ detection:
selection:
cs-method: 'POST'
sc-status: 200
cs-uri-stem|startswith: '/ecp/DDI/DDIService.svc/SetObject'
cs-uri-stem|contains|all:
cs-uri-stem: '/ecp/DDI/DDIService.svc/SetObject'
cs-uri-query|contains|all:
- 'schema=Reset'
- 'VirtualDirectory'
cs-username|endswith: '$'