Detect Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation in Microsoft Sentinel

let SierraWirelessPorts = dynamic([9443, 443, 80, 8080]);
let DangerousExtensions = dynamic(['.php', '.asp', '.aspx', '.jsp', '.cgi', '.sh', '.py', '.pl', '.exe', '.elf']);
let timeWindow = 1h;
union
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(timeWindow)
    | where RemotePort in (SierraWirelessPorts)
    | where InitiatingProcessCommandLine has_any ('curl', 'wget', 'python', 'upload')
    | where RemoteUrl has_any ('acemanager', '/upload', '/cgi-bin', '/firmware')
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessCommandLine, ActionType
),
(
    CommonSecurityLog
    | where TimeGenerated > ago(timeWindow)
    | where DeviceVendor =~ "Sierra Wireless" or DeviceProduct =~ "ALEOS"
    | where Activity has_any ('upload', 'POST', 'file')
    | project TimeGenerated, DeviceAddress, SourceIP, DestinationIP, Activity, AdditionalExtensions
),
(
    W3CIISLog
    | where TimeGenerated > ago(timeWindow)
    | where csMethod == "POST"
    | where csUriStem has_any ('/acemanager', '/upload', '/cgi-bin')
    | extend FileExt = extract(@'(\.[a-zA-Z0-9]+)$', 1, csUriQuery)
    | where FileExt in (DangerousExtensions)
    | project TimeGenerated, cIP, csUriStem, csUriQuery, FileExt, scStatus
)
| extend AlertSeverity = "High"
| extend CVE = "CVE-2018-4063"
| order by TimeGenerated desc