security_content/detections/web/ws_ftp_remote_code_execution.yml at develop · BlueTeamSteve/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
name: WS FTP Remote Code Execution
id: b84e8f39-4e7b-4d4f-9e7c-fcd29a227845
version: 6
date: '2025-05-02'
author: Michael Haag, Splunk
status: production
type: TTP
data_source:
- Suricata
description: The following analytic detects potential Remote Code Execution (RCE)
  attempts exploiting CVE-2023-40044 in WS_FTP software. It identifies HTTP POST requests
  to the "/AHT/AhtApiService.asmx/AuthUser" URL with a status code of 200. This detection
  leverages the Web datamodel to monitor specific URL patterns and HTTP status codes.
  This activity is significant as it may indicate an exploitation attempt, potentially
  allowing an attacker to execute arbitrary code on the server. If confirmed malicious,
  this could lead to unauthorized access, data exfiltration, or further compromise
  of the affected system.
search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web
  where Web.url IN ("/AHT/AhtApiService.asmx/AuthUser") Web.status=200 Web.http_method=POST
  by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src,
  Web.dest, sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `ws_ftp_remote_code_execution_filter`'
how_to_implement: The following analytic requires the Web datamodel. Ensure data source
  is mapped correctly or modify and tune for your data source.
known_false_positives: If WS_FTP Server is not in use, this analytic will not return
  results. Monitor and tune for your environment. Note the MetaSploit module is focused
  on only hitting /AHT/ and not the full /AHT/AhtApiService.asmx/AuthUser URL.
references:
- https://github.com/projectdiscovery/nuclei-templates/pull/8296/files
- https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044
- https://github.com/rapid7/metasploit-framework/pull/18414
drilldown_searches:
- name: View the detection results for - "$dest$"
  search: '%original_detection_search% | search  dest = "$dest$"'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
rba:
  message: Potential WS FTP Remote Code Execution detected against URL $url$ on $dest$
    from $src$
  risk_objects:
  - field: dest
    type: system
    score: 72
  threat_objects:
  - field: src
    type: ip_address
tags:
  cve:
  - CVE-2023-40044
  analytic_story:
  - WS FTP Server Critical Vulnerabilities
  asset_type: Web Server
  atomic_guid: []
  mitre_attack_id:
  - T1190
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: network
tests:
- name: True Positive Test
  attack_data:
  - data:
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/ws_ftp/wsftpweb.log
    source: suricata
    sourcetype: suricata