Sigma rule: CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit

Rule

Title

CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit

Status

test

Level

critical

Author

Sittikorn S, Nuttakorn Tungpoonsup

Date

2021-09-10

Modified

2023-01-02

File

rules-emerging-threats/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_manageengine_adselfservice_exploit.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).

Log source

category

webserver

definition

Must be collect log from \ManageEngine\ADSelfService Plus\logs

Detection

selection:
    cs-uri-query|contains:
        - '/help/admin-guide/Reports/ReportGenerate.jsp'
        - '/RestAPI/LogonCustomization'
        - '/RestAPI/Connection'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• attack.t1190
• attack.persistence
• attack.t1505.003
• cve.2021-40539
• detection.emerging-threats

CVEs this rule names

• CVE-2021-40539

MITRE ATT&CK ids this rule names

• T1190
• T1505.003

References

• https://therecord.media/cisa-warns-of-zoho-server-zero-day-exploited-in-the-wild/
• https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html
• https://us-cert.cisa.gov/ncas/alerts/aa21-259a

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_manageengine_adselfservice_exploit.yml