Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

This rule detects potential exploitation attempts targeting the Centos Web Panel (CWP) 7, specifically looking for indicators related to CVE-2022-44877, an unauthenticated remote code execution vulnerability. The detection logic focuses on POST requests to '/login/index.php' containing specific query parameters and keywords often associated with reverse shells or command injection, such as 'login=$(' or base64 encoded 'python' strings.