""ET EXPLOIT [FIREEYE] Suspicious Pulse Secure HTTP Request (CVE-2021-22893) M3""

SID: 2032906

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Pulse_Secure, created_at 2021_05_05, cve CVE_2021_22893, updated_at 2021_05_05

Reference:

  • cve

  • 2021-22893

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS]

Destination Port: any

Flow: established,to_server

Contents:

  • Value: "MIME|3a 3a|Base64|3b|"

  • Value: "/dana-na/" Depth: 11

  • Value: !"welcome.cgi"

Within:

PCRE:

Special Options:

  • nocase

  • fast_pattern

  • http_uri

  • http_uri

source