OpenPLC ScadaBR Cross-Site Scripting (XSS) Exploitation Detected

union isfuzzy=true
(
    W3CIISLog
    | where csUriStem contains "/ScadaBR" or csHost contains "scadabr" or csUriStem contains "/scada"
    | where csUriQuery matches regex @"(?i)(<script|javascript:|onerror=|onload=|alert\(|document\.cookie|<img[^>]+src[^>]*=|<svg[^>]+onload)"
        or csReferer matches regex @"(?i)(<script|javascript:|onerror=|onload=|alert\()"
    | project TimeGenerated, csHost, csUriStem, csUriQuery, csReferer, cIP, csUsername, scStatus
),
(
    AzureDiagnostics
    | where Category == "ApplicationGatewayFirewallLog"
    | where Message contains "ScadaBR" or requestUri_s contains "/scada"
    | where action_s == "Matched" and ruleSetType_s contains "OWASP"
    | where details_message_s contains "XSS"
    | project TimeGenerated, clientIp_s, requestUri_s, action_s, ruleId_s, details_message_s
),
(
    DeviceNetworkEvents
    | where RemoteUrl contains "scadabr" or RemoteUrl contains "/ScadaBR"
    | where RemoteUrl matches regex @"(?i)(<script|javascript:|onerror=|onload=|alert\(|document\.cookie)"
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
)
| extend CVE = "CVE-2021-26829"
| extend Severity = "High"
| order by TimeGenerated desc

index=web OR index=network OR index=ics
(sourcetype=access_combined OR sourcetype=iis OR sourcetype=waf OR sourcetype=pan_traffic)
(
    (uri="*ScadaBR*" OR uri="*scada*" OR host="*scadabr*")
    AND
    (
        (uri_query IN ("*<script*", "*javascript:*", "*onerror=*", "*onload=*", "*alert(*", "*document.cookie*", "*<img*onerror*", "*<svg*onload*"))
        OR (http_referrer IN ("*<script*", "*javascript:*", "*onerror=*"))
        OR (status=200 AND bytes>0 AND method=POST AND uri="*ScadaBR*")
    )
)
| eval cve="CVE-2021-26829"
| eval severity="high"
| eval attack_type="XSS-ScadaBR"
| stats count AS request_count, values(uri_query) AS payloads, values(src_ip) AS source_ips, dc(src_ip) AS unique_sources, earliest(_time) AS first_seen, latest(_time) AS last_seen BY host, uri, method, status, cve, severity
| where request_count >= 1
| eval first_seen=strftime(first_seen, "%Y-%m-%dT%H:%M:%SZ"), last_seen=strftime(last_seen, "%Y-%m-%dT%H:%M:%SZ")
| table host, uri, method, status, payloads, source_ips, unique_sources, request_count, first_seen, last_seen, cve, severity
| sort - request_count

sequence by source.ip with maxspan=5m
  [network where
    (
      url.path like~ "*ScadaBR*" or
      url.path like~ "*scada*" or
      url.domain like~ "*scadabr*"
    ) and
    (
      url.query like~ "*<script*" or
      url.query like~ "*javascript:*" or
      url.query like~ "*onerror=*" or
      url.query like~ "*onload=*" or
      url.query like~ "*alert(*" or
      url.query like~ "*document.cookie*" or
      http.request.referrer like~ "*<script*" or
      http.request.referrer like~ "*javascript:*"
    )
  ]
  [network where
    (
      url.path like~ "*ScadaBR*" or
      url.path like~ "*scada*"
    ) and
    http.response.status_code == 200
  ]

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
    sourceip,
    destinationip,
    destinationport,
    URL,
    username,
    "HTTP Method" AS http_method,
    "HTTP Response Code" AS response_code,
    CATEGORYNAME(category) AS event_category,
    'CVE-2021-26829' AS cve_id,
    'high' AS severity
FROM events
WHERE
    LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'F5 BIG-IP LTM', 'Palo Alto Networks Firewall')
    AND (
        URL IMATCHES '.*[Ss]cada[Bb][Rr].*'
        OR URL IMATCHES '.*/scada/.*'
        OR DOMAINNAME(URL) IMATCHES '.*scadabr.*'
    )
    AND (
        URL IMATCHES '.*<script.*'
        OR URL IMATCHES '.*javascript:.*'
        OR URL IMATCHES '.*onerror=.*'
        OR URL IMATCHES '.*onload=.*'
        OR URL IMATCHES '.*alert\(.*'
        OR URL IMATCHES '.*document\.cookie.*'
        OR "HTTP Referrer" IMATCHES '.*<script.*'
    )
    AND LOGSOURCETIME(starttime) > NOW() - 24 HOURS
ORDER BY starttime DESC
LAST 7 DAYS

_sourceCategory=web/access OR _sourceCategory=network/proxy OR _sourceCategory=ics/web
| parse "* * * \"* *?*\" * *" as client_ip, ident, auth_user, method, uri_path, query_string, status_code, bytes nodrop
| where uri_path matches "*ScadaBR*" or uri_path matches "*scada*"
| where 
    query_string matches "*<script*" or
    query_string matches "*javascript:*" or
    query_string matches "*onerror=*" or
    query_string matches "*onload=*" or
    query_string matches "*alert(*" or
    query_string matches "*document.cookie*" or
    query_string matches "*<img*" or
    query_string matches "*<svg*"
| withtime _messagetime
| eval cve = "CVE-2021-26829"
| eval attack_category = "XSS-ICS-SCADA"
| count by client_ip, uri_path, method, status_code, cve, attack_category
| sort by _count desc
| fields client_ip, uri_path, method, status_code, _count, cve, attack_category

rule cve_2021_26829_scadabr_xss {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects XSS exploitation attempts targeting OpenPLC ScadaBR (CVE-2021-26829)"
    severity = "HIGH"
    priority = "HIGH"
    cve = "CVE-2021-26829"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-26829"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($http.target.url, `(?i)scadabr`) or
      re.regex($http.target.file.full_path, `(?i)/[Ss]cada[Bb][Rr]/`) or
      re.regex($http.target.file.full_path, `(?i)/scada/`)
    )
    (
      re.regex($http.target.url, `(?i)(<script|javascript:|onerror=|onload=|alert\(|document\.cookie|<img[^>]+onerror|<svg[^>]+onload)`) or
      re.regex($http.network.http.referral_url, `(?i)(<script|javascript:|onerror=)`)
    )

  condition:
    $http
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkConnectIP6 OR #event_simpleName=SuspiciousHttpRequest
| RemotePort = 80 OR RemotePort = 443 OR RemotePort = 8080 OR RemotePort = 8443
| HttpUrl = "*ScadaBR*" OR HttpUrl = "*scadabr*" OR HttpUrl = "*/scada/*"
| HttpUrl = "*<script*" OR HttpUrl = "*javascript:*" OR HttpUrl = "*onerror=*" OR HttpUrl = "*onload=*" OR HttpUrl = "*alert(*" OR HttpUrl = "*document.cookie*"
| eval CVE = "CVE-2021-26829"
| eval ThreatCategory = "XSS-ICS-SCADA"
| stats count() AS RequestCount, values(HttpUrl) AS ObservedURLs, values(RemoteIP) AS TargetIPs BY aid, ComputerName, UserName, CVE, ThreatCategory
| sort - RequestCount