CVE-2021-20021

Sentinel/Defender KQL

DeviceNetworkEvents
| where RemotePort == 80 or RemotePort == 443 // Assuming HTTP/HTTPS traffic to the Email Security appliance
| where InitiatingProcessFileName contains "httpd" or InitiatingProcessFileName contains "nginx" // Common web server processes
| where RemoteUrl contains "/admin/" and RequestMethod == "POST" // Or other paths indicative of admin account creation
| where ResponseCode == 200 or ResponseCode == 302 // Successful or redirect after account creation
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, RequestMethod, ResponseCode, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend AlertMessage = "Potential CVE-2021-20021 exploitation attempt: Admin account creation via crafted HTTP request."

Splunk SPL

index=web sourcetype=access_combined (port=80 OR port=443) (uri_path="/admin/*" AND method="POST") (status=200 OR status=302)
| table _time, host, clientip, uri_path, method, status, user_agent
| rename clientip AS attacker_ip, uri_path AS requested_path
| eval AlertMessage = "Potential CVE-2021-20021 exploitation attempt: Admin account creation via crafted HTTP request."

Sigma

title: SonicWall Email Security CVE-2021-20021 Exploitation Attempt
author: SecBoard
date: 2024/07/30
logsource:
  category: webserver
  product: sonicwall_email_security
detection:
  selection:
    http_method: "POST"
    http_path|contains: "/admin/"
    http_status: [200, 302]
  condition: selection
fields:
  - http_method
  - http_path
  - http_status
  - source_ip
  - destination_ip
  - user_agent
tags:
  - attack.initial_access
  - cve.2021.20021
  - exploitation
level: critical

Elastic ES|QL

from logs-web-access*
| where http.request.method == "POST"
| where http.request.url.path like "/admin/%"
| where http.response.status_code == 200 or http.response.status_code == 302
| select @timestamp, host.name, source.ip, http.request.method, http.request.url.path, http.response.status_code, user_agent.original
| append {
    from logs-web-access*
    | where http.request.method == "POST"
    | where http.request.url.path like "/admin/%"
    | where http.response.status_code == 200 or http.response.status_code == 302
    | eval AlertMessage = "Potential CVE-2021-20021 exploitation attempt: Admin account creation via crafted HTTP request."
}