Skip to content

Commit d4a8d19

Browse files
authored
fix attempts typo (#1599)
1 parent 5723ed5 commit d4a8d19

File tree

6 files changed

+6
-6
lines changed

6 files changed

+6
-6
lines changed

scenarios/crowdsecurity/apache_log4j2_cve-2021-44228.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ type: trigger
22
format: 2.0
33
#debug: true
44
name: crowdsecurity/apache_log4j2_cve-2021-44228
5-
description: "Detect cve-2021-44228 exploitation attemps"
5+
description: "Detect cve-2021-44228 exploitation attempts"
66
filter: |
77
evt.Meta.log_type in ["http_access-log", "http_error-log"] and
88
(

scenarios/crowdsecurity/fortinet-cve-2018-13379.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
type: trigger
22
format: 2.0
33
name: crowdsecurity/fortinet-cve-2018-13379
4-
description: "Detect cve-2018-13379 exploitation attemps"
4+
description: "Detect cve-2018-13379 exploitation attempts"
55
filter: |
66
evt.Meta.log_type in ["http_access-log", "http_error-log"] and
77
Upper(evt.Meta.http_path) contains Upper('/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession')

scenarios/crowdsecurity/jira_cve-2021-26086.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ type: trigger
22
format: 2.0
33
#debug: true
44
name: crowdsecurity/jira_cve-2021-26086
5-
description: "Detect Atlassian Jira CVE-2021-26086 exploitation attemps"
5+
description: "Detect Atlassian Jira CVE-2021-26086 exploitation attempts"
66
filter: |
77
evt.Meta.log_type in ["http_access-log", "http_error-log"] and any(File("jira_cve_2021-26086.txt"), {Upper(evt.Meta.http_path) contains Upper(#)})
88
data:

scenarios/crowdsecurity/pulse-secure-sslvpn-cve-2019-11510.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
type: trigger
22
format: 2.0
33
name: crowdsecurity/pulse-secure-sslvpn-cve-2019-11510
4-
description: "Detect cve-2019-11510 exploitation attemps"
4+
description: "Detect cve-2019-11510 exploitation attempts"
55
filter: |
66
evt.Meta.log_type in ["http_access-log", "http_error-log"] and
77
(Upper(evt.Meta.http_path) matches Upper('/dana-na/../dana/html5acc/guacamole/../../../../../../../[^?]+\\?/dana/html5acc/guacamole/')

scenarios/crowdsecurity/thinkphp-cve-2018-20062.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ type: trigger
22
format: 2.0
33
#debug: true
44
name: crowdsecurity/thinkphp-cve-2018-20062
5-
description: "Detect ThinkPHP CVE-2018-20062 exploitation attemps"
5+
description: "Detect ThinkPHP CVE-2018-20062 exploitation attempts"
66
filter: |
77
evt.Meta.log_type in ["http_access-log", "http_error-log"] and RegexpInFile(Lower(evt.Meta.http_path), "thinkphp_cve_2018-20062.txt")
88
data:

scenarios/crowdsecurity/vmware-vcenter-vmsa-2021-0027.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
type: trigger
22
format: 2.0
33
name: crowdsecurity/vmware-vcenter-vmsa-2021-0027
4-
description: "Detect VMSA-2021-0027 exploitation attemps"
4+
description: "Detect VMSA-2021-0027 exploitation attempts"
55
filter: |
66
evt.Meta.log_type in ['http_access-log', 'http_error-log'] && evt.Meta.http_path matches '/ui/vcav-bootstrap/rest/vcav-providers/provider-logo\\?url=(file|http)'
77
groupby: "evt.Meta.source_ip"

0 commit comments

Comments
 (0)