""ET EXPLOIT NUUO OS Command Injection M2""

SID: 2026108

Revision: 1

Class Type: attempted-admin

Metadata: attack_target Networking_Equipment, created_at 2018_09_10, deployment Perimeter, signature_severity Major, updated_at 2018_09_10, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services

Reference:

• Link

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: $HOME_NET

Destination Port: $HTTP_PORTS

Flow: to_server,established

Contents:

• Value: "/cgi_system?cmd=saveconfig"

• Value: "bfolder="

Within:

PCRE: "/(?:\x60|\x24)/P"

Special Options:

• http_uri

• http_client_body

source