Exploitation of CVE-2021-26814 in Wazuh

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•32

Detects the exploitation of the Wazuh RCE vulnerability described in CVE-2021-26814. This rule specifically looks for a URI query containing '/manager/files?path=etc/lists/../../../../..' which is indicative of a path traversal attempt to access sensitive files outside the intended directory.