Potential CVE-2022-46169 Exploitation Attempt

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects potential exploitation attempts targeting the Cacti Command Injection vulnerability, CVE-2022-46169. The rule looks for specific patterns in GET requests to '/remote_agent.php' with 'action=polldata' and 'poller_id=' in the query, combined with suspicious command injection payloads like 'base64 -d | /bin/bash', 'whoami', 'powershell', 'cmd', or 'wget'.