CVE-2021-22893

Sentinel/Defender KQL

CommonSecurityLog
| where DeviceVendor == "Pulse Secure" and DeviceProduct == "Pulse Connect Secure"
| where Message has_any ("/+dana/+meeting", "/+dana/+fb/+smb", "/+dana-cached/+fb/+smb", "/+dana-ws/+namedusers", "/+dana-ws/+metric")
| where EventType == "Unauthenticated Request" // Requires 'Unauthenticated Requests' logging to be enabled
| project TimeGenerated, DeviceName, SourceIP, RequestUri, Message

Splunk SPL

sourcetype="pulsesecure:connect:secure" (uri_path="*/dana/meeting*" OR uri_path="*/dana/fb/smb*" OR uri_path="*/dana-cached/fb/smb*" OR uri_path="*/dana-ws/namedusers*" OR uri_path="*/dana-ws/metric*") status=401 // Assuming 401 for unauthenticated attempts, adjust if logs show other codes for blocked requests
| table _time, host, src_ip, uri_path, status

Sigma

title: Pulse Connect Secure CVE-2021-22893 Exploitation Attempt
author: SecBoard
logsource:
  product: pulsesecure
  service: connect_secure
detection:
  selection:
    uri_path|contains:
      - '/dana/meeting'
      - '/dana/fb/smb'
      - '/dana-cached/fb/smb'
      - '/dana-ws/namedusers'
      - '/dana-ws/metric'
  condition: selection
  falsepositives:
    - Legitimate use of Windows File Share Browser, Pulse Secure Collaboration, or License Server features (if workaround is not applied and these features are in use).
level: critical

Elastic ES|QL

FROM logs-pulsesecure.connect_secure-*
| WHERE url.path : ("*/dana/meeting*", "*/dana/fb/smb*", "*/dana-cached/fb/smb*", "*/dana-ws/namedusers*", "*/dana-ws/metric*")
| WHERE http.response.status_code == 401 // Adjust status code if logs show different for blocked unauthenticated requests
| SELECT @timestamp, host.name, source.ip, url.path, http.response.status_code