24 lines
760 B
YAML
24 lines
760 B
YAML
title: NetScaler Encoded Diagnostic Command In Request Context
|
|
id: 34bd2f41-877e-4e16-91a5-4aeb62dddc21
|
|
name: example_decoded_diagnostic_command
|
|
status: experimental
|
|
description: >-
|
|
Synthetic example matching a decoded identity command in an HTTP request.
|
|
A match does not prove execution and authorized diagnostics can match.
|
|
author: NetScaler Triage contributors
|
|
references:
|
|
- https://sigmahq.io/sigma-specification/specification/sigma-rules-specification.html
|
|
logsource:
|
|
product: netscaler
|
|
service: http_access
|
|
detection:
|
|
selection:
|
|
uri|startswith: /vpn/
|
|
raw|re: '^id$'
|
|
excluded:
|
|
uri|contains: /health
|
|
condition: selection and not excluded
|
|
falsepositives:
|
|
- Authorized security tests and administrative diagnostics.
|
|
level: low
|