Sigma rule: Potential CVE-2022-46169 Exploitation Attempt

Rule

Title

Potential CVE-2022-46169 Exploitation Attempt

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-12-27

Modified

2023-01-02

File

rules-emerging-threats/2022/Exploits/CVE-2022-46169/web_cve_2022_46169_cacti_exploitation_attempt.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169

Log source

category

webserver

Detection

selection:
    # Check for the presence of the X-FORWARDED-FOR header pointing to the hostname of the server running Cacti (which indicate auth bypass)
    # Check for previous requests indicating the bruteforce of the "local_data_ids" and "host_id"
    cs-method: 'GET'
    cs-uri-query|contains|all:
        - '/remote_agent.php'
        - 'action=polldata'
        - 'poller_id='
    cs-uri-query|contains:
        # From https://github.com/rapid7/metasploit-framework/pull/17407/files#diff-972a47250ccd30b935a59e8871134956a15980df5b29f9d970414646704d5258R288
        # Not tested could be shown in other format (update if you have more info)
        - '| base64 -d | /bin/bash`'
        - '%7C%20base64%20-d%20%7C%20%2Fbin%2Fbash%60' # URL encoded version
        # Add more suspicious commands accordingly
        - '`whoami'
        - 'powershell'
        - 'cmd'
        - 'wget'
condition: selection

False positives (as the rule lists them)

• Web vulnerability scanners

Tags

• attack.initial-access
• attack.t1190
• cve.2022-46169
• detection.emerging-threats

CVEs this rule names

• CVE-2022-46169

MITRE ATT&CK ids this rule names

• T1190

References

• https://github.com/0xf4n9x/CVE-2022-46169
• https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf
• https://github.com/rapid7/metasploit-framework/pull/17407

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2022/Exploits/CVE-2022-46169/web_cve_2022_46169_cacti_exploitation_attempt.yml