Detect Sierra Wireless AirLink ALEOS Unrestricted File Upload Exploitation in Splunk

index=network OR index=syslog OR index=proxy
| eval time_window=relative_time(now(), "-1h")
| where _time >= time_window
(
  [search sourcetype IN (cisco:asa, pan:traffic, paloalto:firewall)
   dest_port IN (9443, 443, 80, 8080)
   (url="*acemanager*" OR url="*/upload*" OR url="*/cgi-bin*" OR uri_path="*/firmware*")
   http_method=POST]
OR
  [search sourcetype=sierrawireless:aleos
   (message="*upload*" OR message="*file*" OR message="*POST*")]
OR
  [search sourcetype IN (access_combined, iis)
   method=POST
   (uri_path="*acemanager*" OR uri_path="*/upload*" OR uri_path="*/cgi-bin*")
   (uri_path="*.php" OR uri_path="*.asp" OR uri_path="*.aspx" OR uri_path="*.jsp" OR uri_path="*.cgi" OR uri_path="*.sh" OR uri_path="*.elf")]
)
| eval dangerous_ext=if(match(uri_path, "\.(php|asp|aspx|jsp|cgi|sh|py|pl|exe|elf)$"), "true", "false")
| eval cve="CVE-2018-4063"
| eval vendor="Sierra Wireless"
| eval product="AirLink ALEOS"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips values(uri_path) as upload_paths values(dangerous_ext) as file_types by dest_ip dest_port
| where count > 0
| sort -last_seen