CVE-2024-1212 Exploitation - Progress Kemp LoadMaster Unauthenticated Command Injection

SigmaHQ Detections@sigmaHQ

•updated Feb 3, 2025•0•26

Detects potential exploitation of CVE-2024-1212, an unauthenticated command injection vulnerability in Progress Kemp LoadMaster. The rule specifically looks for GET requests to the '/access/set' API with the parameters 'param=enableapi' and 'value=1', combined with an "Authorization" header containing a base64 encoded value with uncommon characters, indicative of an attempted exploit.