Which SIEM platforms have a CVE-2018-4063 detection rule?

df00tech provides CVE-2018-4063 (Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the CVE-2018-4063 detection?

The CVE-2018-4063 detection is rated critical severity with medium confidence.

What are common false positives for CVE-2018-4063?

Common false positives for CVE-2018-4063 include: Legitimate firmware upgrades performed by authorized network administrators via ACEmanager; Authorized configuration file uploads during scheduled maintenance windows; Security scanning tools probing ALEOS management interfaces as part of authorized vulnerability assessments.

CVE-2018-4063 Microsoft Sentinel · KQL

Detect Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation in Microsoft Sentinel

Q: What data sources are required to detect Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation (CVE-2018-4063)?

Detecting Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation requires the following data sources: DeviceNetworkEvents, CommonSecurityLog, W3CIISLog, Syslog.

Detects exploitation of CVE-2018-4063, an unrestricted file upload vulnerability (CWE-434) in Sierra Wireless AirLink ALEOS firmware. Attackers can upload files with dangerous types via the ACEmanager web interface, enabling remote code execution on cellular gateway devices. This vulnerability is listed in CISA KEV and has been exploited in the wild against critical infrastructure.

MITRE ATT&CK

Tactic: Initial Access Execution Lateral Movement

KQL Detection Query

Microsoft Sentinel (KQL)

kusto

let SierraWirelessPorts = dynamic([9443, 443, 80, 8080]);
let DangerousExtensions = dynamic(['.php', '.asp', '.aspx', '.jsp', '.cgi', '.sh', '.py', '.pl', '.exe', '.elf']);
let timeWindow = 1h;
union
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(timeWindow)
    | where RemotePort in (SierraWirelessPorts)
    | where InitiatingProcessCommandLine has_any ('curl', 'wget', 'python', 'upload')
    | where RemoteUrl has_any ('acemanager', '/upload', '/cgi-bin', '/firmware')
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessCommandLine, ActionType
),
(
    CommonSecurityLog
    | where TimeGenerated > ago(timeWindow)
    | where DeviceVendor =~ "Sierra Wireless" or DeviceProduct =~ "ALEOS"
    | where Activity has_any ('upload', 'POST', 'file')
    | project TimeGenerated, DeviceAddress, SourceIP, DestinationIP, Activity, AdditionalExtensions
),
(
    W3CIISLog
    | where TimeGenerated > ago(timeWindow)
    | where csMethod == "POST"
    | where csUriStem has_any ('/acemanager', '/upload', '/cgi-bin')
    | extend FileExt = extract(@'(\.[a-zA-Z0-9]+)$', 1, csUriQuery)
    | where FileExt in (DangerousExtensions)
    | project TimeGenerated, cIP, csUriStem, csUriQuery, FileExt, scStatus
)
| extend AlertSeverity = "High"
| extend CVE = "CVE-2018-4063"
| order by TimeGenerated desc

critical severity medium confidence

Detects HTTP POST requests to Sierra Wireless AirLink ALEOS ACEmanager endpoints with dangerous file extensions, network connections to known ALEOS management ports with upload activity, and syslog events from Sierra Wireless devices indicating file upload operations.

Data Sources

DeviceNetworkEventsCommonSecurityLogW3CIISLogSyslog

Required Tables

DeviceNetworkEventsCommonSecurityLogW3CIISLog

False Positives & Tuning

Legitimate firmware upgrades performed by authorized network administrators via ACEmanager
Authorized configuration file uploads during scheduled maintenance windows
Security scanning tools probing ALEOS management interfaces as part of authorized vulnerability assessments
Network monitoring solutions polling ALEOS device status via management APIs

Other platforms for CVE-2018-4063

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Simulate File Upload to ALEOS ACEmanager Endpoint
Expected signal: HTTP POST to port 9443 with multipart/form-data body containing a .php file extension; network flow from attacker IP to ALEOS management IP
Test 2Upload ELF Binary to ALEOS CGI Directory
Expected signal: POST request to /cgi-bin/upload with Content-Disposition header containing filename ending in .elf; successful HTTP 200 response if device is unpatched
Test 3Enumerate ALEOS ACEmanager Upload Endpoints
Expected signal: Sequential GET requests from a single source IP to multiple ALEOS management paths within a short time window; HTTP response codes indicating which paths are accessible

Last updated: 2026-06-19 Research depth: standard

References (4)

Response Playbook

Triage

Identify the source IP of the POST request and determine whether it belongs to a known authorized administrator IP range or NAT address used by the network operations team.
Inspect the uploaded file extension and content type in proxy or web server logs — prioritize PHP, CGI, shell scripts, and ELF binaries as they indicate likely webshell or implant staging.
Determine the specific ALEOS device targeted (by destination IP) and cross-reference against your asset inventory to assess criticality — prioritize devices in OT/ICS environments, remote sites, or those with access to internal networks.
Check whether the upload resulted in a successful HTTP 200 response, which would indicate the file was accepted by the ALEOS ACEmanager interface.

Containment

If exploitation is confirmed, immediately isolate the affected Sierra Wireless AirLink device by blocking its management port (default 9443/TCP) at the upstream firewall or network access control boundary.
Revoke and rotate all credentials (ACEmanager admin password, VPN certificates, API keys) associated with the compromised ALEOS device to prevent lateral movement via established sessions.
If the device provides cellular WAN connectivity to critical infrastructure, evaluate a controlled failover to a backup link before isolation to preserve availability during the incident response.

Evidence Collection

Capture and preserve ACEmanager web server access logs from the ALEOS device, including the raw HTTP request containing the uploaded file name, content type header, and source IP.
If physically accessible, obtain a firmware dump or system snapshot of the ALEOS device to identify any unauthorized files deposited in web-accessible directories or persistent storage.
Collect NetFlow or PCAP data showing outbound connections from the ALEOS device in the 24 hours following the suspicious upload event to detect C2 callbacks or data exfiltration.

Escalation Criteria

!Escalate immediately to the incident response team if the uploaded file has been accessed (subsequent GET request to the same path), indicating a deployed webshell or reverse shell has been triggered.
!Escalate to OT/ICS security team and notify CISA if the compromised ALEOS device bridges IT and operational technology networks, given the ICS advisory context (ICSA-19-122-03) for this vulnerability.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

>ACEmanager HTTP access log entries showing POST requests to /upload, /cgi-bin, or /firmware paths with non-standard file extensions
>ALEOS device filesystem artifacts: unexpected files in web-accessible directories (/www, /cgi-bin) with executable permissions
>Outbound network connections from the ALEOS device IP to non-Sierra-Wireless external IPs on uncommon ports following the upload event
>Authentication logs showing repeated or anomalous ACEmanager login attempts immediately preceding the file upload

Tuning Guidance

Reduce false positives by building an allowlist of authorized ACEmanager administrator source IPs and scheduled maintenance windows. Restrict alerting to file extensions that are definitively executable on ALEOS firmware (ELF, CGI, SH) for higher-confidence alerts, and use the broader extension list (PHP, ASP, JSP) as a medium-confidence supplemental hunt. If Sierra Wireless devices are managed by a central NMS, exclude that NMS IP from triggering. Consider baselining normal firmware upgrade frequency per device and alerting on deviations.

Hunting Queries

Broad hunt across 7 days for any repeated upload or POST activity against Sierra Wireless ALEOS management interfaces, surfacing low-and-slow attack patterns that single-event rules may miss.

Hunting — KQL

kql

CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor =~ "Sierra Wireless" or DeviceProduct =~ "ALEOS"
| where Activity has_any ('upload', 'POST', 'file', 'firmware')
| summarize count() by SourceIP, DestinationIP, Activity, bin(TimeGenerated, 1h)
| where count_ > 3
| order by TimeGenerated desc

Hunting — SPL

spl

index=network sourcetype IN (sierrawireless:aleos, access_combined)
(message="*upload*" OR method=POST) (uri_path="*acemanager*" OR uri_path="*/cgi-bin*")
| stats count by src_ip, dest_ip, uri_path, _time
| where count > 1
| sort -_time

Atomic Red Team Tests

Test 1 Simulate File Upload to ALEOS ACEmanager Endpoint

linux

Simulates an attacker uploading a PHP webshell to the ACEmanager web interface of a Sierra Wireless AirLink device. Run only in an isolated lab with a test ALEOS unit.

Command

bash

curl -k -X POST https://TARGET_ALEOS_IP:9443/upload -u admin:admin -F 'file=@/tmp/test_shell.php' -H 'Content-Type: multipart/form-data' -v

Cleanup

bash

curl -k -X DELETE https://TARGET_ALEOS_IP:9443/upload/test_shell.php -u admin:admin

Expected Telemetry

HTTP POST to port 9443 with multipart/form-data body containing a .php file extension; network flow from attacker IP to ALEOS management IP

Expected Detection

Alert triggers on POST request matching acemanager/upload path with .php extension in proxy logs or network telemetry

Test 2 Upload ELF Binary to ALEOS CGI Directory

linux

Simulates uploading a compiled ELF binary (reverse shell) to the ALEOS CGI directory, which would execute with device-level privileges if successful.

Command

bash

# Create a benign ELF placeholder for lab testing
echo 'ELF_PLACEHOLDER' > /tmp/test_implant.elf
curl -k -X POST https://TARGET_ALEOS_IP:9443/cgi-bin/upload -u admin:admin -F 'firmware=@/tmp/test_implant.elf' -v

Cleanup

bash

rm /tmp/test_implant.elf

Expected Telemetry

POST request to /cgi-bin/upload with Content-Disposition header containing filename ending in .elf; successful HTTP 200 response if device is unpatched

Expected Detection

Alert triggers on POST to /cgi-bin path with .elf file extension in network monitoring or web proxy logs

Test 3 Enumerate ALEOS ACEmanager Upload Endpoints

linux

Simulates attacker reconnaissance of Sierra Wireless ALEOS management interface to identify upload-capable endpoints before exploitation.

Command

bash

# Discovery phase — enumerate known ALEOS management paths
for path in /acemanager /upload /cgi-bin /firmware /config /update; do
  curl -k -o /dev/null -s -w "%{http_code} %{url_effective}\n" https://TARGET_ALEOS_IP:9443${path}
done

Cleanup

bash

# No cleanup needed — read-only enumeration

Expected Telemetry

Sequential GET requests from a single source IP to multiple ALEOS management paths within a short time window; HTTP response codes indicating which paths are accessible

Expected Detection

Behavioral detection on rapid sequential requests to management paths from a non-whitelisted IP; triggers on scanning pattern in network logs

Related Detections

Tactic Hubs

TA0001Initial Access TA0002Execution TA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter T1021Remote Services

Detect Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation in Microsoft Sentinel

MITRE ATT&CK

KQL Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2018-4063

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

MITRE ATT&CK

KQL Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2018-4063

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox