Detect Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation in Google Chronicle

rule cve_2018_4063_aleos_unrestricted_upload {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2018-4063: Sierra Wireless AirLink ALEOS unrestricted file upload exploitation via ACEmanager"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://www.cisa.gov/news-events/ics-advisories/icsa-19-122-03"
    cve = "CVE-2018-4063"
    mitre_attack = "T1190, T1059"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = "POST"
    (
      $http.network.http.request_url = /acemanager/i
      or $http.network.http.request_url = /\/upload/i
      or $http.network.http.request_url = /\/cgi-bin/i
      or $http.network.http.request_url = /\/firmware/i
    )
    (
      $http.network.http.request_url = /\.php$/i
      or $http.network.http.request_url = /\.asp$/i
      or $http.network.http.request_url = /\.aspx$/i
      or $http.network.http.request_url = /\.jsp$/i
      or $http.network.http.request_url = /\.cgi$/i
      or $http.network.http.request_url = /\.sh$/i
      or $http.network.http.request_url = /\.elf$/i
      or $http.network.http.request_url = /\.py$/i
    )
    $http.network.application_protocol = "HTTP" or $http.network.application_protocol = "HTTPS"
    $http.principal.ip = $source_ip
    $http.target.ip = $dest_ip

  condition:
    $http
}