diff --git a/CVE-2019-0232/cve-2019-0232.rules b/CVE-2019-0232/cve-2019-0232.rules index 90888a8..2af9950 100644 --- a/CVE-2019-0232/cve-2019-0232.rules +++ b/CVE-2019-0232/cve-2019-0232.rules @@ -1 +1 @@ -alert http any any -> any any (msg: "ATTACK [PTsecurity] Apache Tomcat RCE on Windows (CVE-2019-0232)"; flow: established, to_server; content: "?&"; http_raw_uri; pcre: "/\.(?:bat|cmd)\?\&/I"; reference: cve, 2019-0232; reference: url, wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232; reference: url, github.com/ptresearch/AttackDetection; metadata: Open Ptsecurity.com ruleset; classtype: attempted-admin; sid: 10004953; rev: 1;) +alert http any any -> any any (msg: "ATTACK [PTsecurity] Apache Tomcat RCE on Windows (CVE-2019-0232)"; flow: established, to_server; content: "?&"; http_raw_uri; pcre: "/\.(?:bat|cmd)\?\&/I"; reference: cve, 2019-0232; reference: url, wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232; reference: url, github.com/ptresearch/AttackDetection; metadata: Open Ptsecurity.com ruleset; classtype: attempted-admin; sid: 10004953; rev: 2;)