Sigma rule: Rejetto HTTP File Server RCE

Rule

Title

Rejetto HTTP File Server RCE

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-07-19

Modified

2023-01-02

File

rules-emerging-threats/2014/Exploits/CVE-2014-6287/web_cve_2014_6287_hfs_rce.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287

Log source

category

webserver

Detection

selection_search:
    cs-uri-query|contains: '?search=%00{.'
selection_payload:
    cs-uri-query|contains:
        - 'save|' # Indication of saving a file which shouldn't be tested by vuln scanners
        - 'powershell'
        - 'cmd.exe'
        - 'cmd /c'
        - 'cmd /r'
        - 'cmd /k'
        - 'cscript'
        - 'wscript'
        - 'python'
        - 'C:\Users\Public\'
        - '%comspec%'
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence
• attack.initial-access
• attack.t1190
• attack.t1505.003
• cve.2014-6287
• detection.emerging-threats

CVEs this rule names

• CVE-2014-6287

MITRE ATT&CK ids this rule names

• T1190
• T1505.003

References

• https://vk9-sec.com/hfs-code-execution-cve-2014-6287/
• https://www.exploit-db.com/exploits/39161
• https://github.com/Twigonometry/Cybersecurity-Notes/blob/c875b0f52df7d2c7a870e75e1f0c2679d417931d/Writeups/Hack%20the%20Box/Boxes/Optimum/10%20-%20Website.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2014/Exploits/CVE-2014-6287/web_cve_2014_6287_hfs_rce.yml