From d150d8dcf0d13487f5869313d20673006dc2ea69 Mon Sep 17 00:00:00 2001 From: ditekshen Date: Tue, 29 Aug 2023 13:58:39 +0300 Subject: [PATCH] Add Snort detection against CVE-2023-36844 --- snort/snort3.rules | 1 + 1 file changed, 1 insertion(+) diff --git a/snort/snort3.rules b/snort/snort3.rules index 7133086..352135a 100644 --- a/snort/snort3.rules +++ b/snort/snort3.rules @@ -309,6 +309,7 @@ alert http $HOME_NET any -> $EXTERNAL_NET any ( msg:"MALWARE-CNC Win.Trojan.Lumm alert http $HOME_NET any -> $EXTERNAL_NET any ( msg:"MALWARE-CNC Win.Trojan.AgnianeStealer outbound connection detected"; flow:to_server,established; http_uri; content:".php?ownerid=",fast_pattern; content:"buildid="; http_method; content:"POST"; metadata:ruleset community, service http; rem:"yara:MALWARE_Win_AgnianeStealer, clamav:MALWARE.Win.Trojan.AgnianeStealer"; classtype:trojan-activity; sid:923828001; rev:1; ) alert tcp $HOME_NET any -> $EXTERNAL_NET [25,26,587] ( msg:"MALWARE-CNC Win.Trojan.KrakenStealer outbound SMTP connection detected"; flow:to_server,established; content:"Recovered From:",fast_pattern; metadata:ruleset community, service smtp, imap, pop3; rem:"yara:MALWARE_Win_KrakenStealer"; classtype:trojan-activity; sid:923828002; rev:1; ) alert udp $HOME_NET any -> $EXTERNAL_NET 53 ( msg:"MALWARE-CNC Win.Trojan.BlankStealer outbound DNS request detected"; flow:to_server; content:"|0b|blank-",fast_pattern; content:"|02|in",within 7,distance 5; metadata:impact_flag red,policy balanced-ips drop,policy max-detect-ips drop,policy security-ips drop,ruleset community; service:dns; reference:url,capesandbox.com/analysis/444899/; reference:url,www.virustotal.com/gui/file/c9848988c90013fb86d016a7bd4e761a1319d3f8dc669fe6d85fec34c1e73256/detection; classtype:trojan-activity; sid:923829001; rev:1; ) +alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS ( msg:"SERVER-WEBAPP Juniper RCE CVE-2023-36844 exploit attempt detected"; flow:to_server,established; http_uri; content:"/webauth_operation.php"; http_client_body; content:"rs=do_upload"; content:"rsargs",distance 0; content:"fileData",distance 0; content:";base64"; content:"fileName",nocase; http_method; content:"POST"; metadata:ruleset community, service http; reference:cve,2023-36844; reference:cve,2023-36845; reference:cve,2023-36846; reference:cve,2023-36847; reference:url,labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/; reference:url,github.com/watchtowrlabs/juniper-rce_cve-2023-36844; classtype:attempted-admin; sid:923829002; rev:1; ) ################################################ # INDICATOR PACKED ################################################