SonicWall SSL/VPN Jarrewrite Exploitation Attempt

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•23

Detects exploitation attempts of the SonicWall SSL/VPN Jarrewrite vulnerability. The rule looks for requests to '/cgi-bin/jarrewrite.sh' combined with specific patterns in the 'cs-user-agent' header that indicate command injection attempts, such as ':;', '() {', or '/bin/bash -c'. This targets a known vulnerability allowing attackers to execute arbitrary commands.