Yara Rule - IIS 로그에서 찾을 때 인증 우회전을 허용하는 2024 Connectwise SceenCennect (23.9.8 이전 버전) 취약점의 감염의 잠재적 인 지표 인 다음과 같은 '/setupwizard.aspx/'에 대한 HTTP 요청을 감지
Yara 정의.
Yara Rule - Detects an http request to ‘/SetupWizard.aspx/’ with anything following it, which when found in IIS logs is a potential indicator of compromise of the 2024 ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass
Yara definition.
Author: Huntress DE&TH Team (modified by Florian Roth)
https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
date = "2024-02-20"
modified = "2024-02-21"
id = "2886530b-e164-4c4b-b01e-950e3c40acb4"
$s1 = " GET /SetupWizard.aspx/" ascii
$s2 = " POST /SetupWizard.aspx/" ascii```
[https://github.com/Neo23x0/signature-base/commit/f1c712959094738fda26a20d877e98f86714411c](https://github.com/Neo23x0/signature-base/commit/f1c712959094738fda26a20d877e98f86714411c)