add keywords condition

2021-08-17 06:24:04 +02:00
parent 32fc191163
commit e098fc73cb
1 changed files with 8 additions and 1 deletions
@@ -19,7 +19,14 @@ detection:
            - 'schema=Reset'
            - 'VirtualDirectory'
        cs-username|endswith: '$'
-    condition: selection
+    keywords:
+        - 'POST'
+        - '200'
+        - '/ecp/DDI/DDIService.svc/SetObject'
+        - 'schema=Reset'
+        - 'VirtualDirectory'
+        - '$'    
+    condition: selection or all of keywords
 falsepositives:
    - Unlikely
 level: critical