Sigma rule: Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877

Rule

Title

Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-01-20

File

rules-emerging-threats/2022/Exploits/CVE-2022-44877/web_cve_2022_44877_exploitation_attempt.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877

Log source

category

webserver

Detection

selection:
    cs-method: 'POST'
    cs-uri-query|contains|all:
        - '/login/index.php'
        - 'login='
    cs-uri-query|contains:
        # TOD: Include other commonly used reverse shells. Examples: https://www.revshells.com/
        - 'login=$('
        # Common keywords related to python reverse shells
        - 'base64'
        - 'subprocess'
        - 'socket'
        - '${IFS}' # Usage of the input field separator to avoid writing spaces
        # B64 Encoded "python" with different offsets
        - 'cHl0aG9u'
        - 'B5dGhvb'
        - 'weXRob2'
condition: selection

False positives (as the rule lists them)

• Web vulnerability scanners

Tags

• attack.initial-access
• attack.t1190
• cve.2022-44877
• detection.emerging-threats

CVEs this rule names

• CVE-2022-44877

MITRE ATT&CK ids this rule names

• T1190

References

• https://seclists.org/fulldisclosure/2023/Jan/1
• https://www.rapid7.com/blog/post/2023/01/19/etr-exploitation-of-control-web-panel-cve-2022-44877/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2022/Exploits/CVE-2022-44877/web_cve_2022_44877_exploitation_attempt.yml