TerraMaster TOS CVE-2020-28188 Exploitation Attempt

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects exploitation attempts targeting the TerraMaster TOS vulnerability CVE-2020-28188. This rule specifically looks for GET requests to '/include/makecvs.php' with a '?Event=' parameter, combined with common command injection payloads such as 'curl', 'wget', '.py', '.sh', 'chmod', or '_GET' in the URI query.