type: trigger
format: 2.0
name: crowdsecurity/CVE-2023-49103
description: "Detect owncloud CVE-2023-49103 exploitation attempts"
filter: |
  evt.Meta.log_type in ['http_access-log', 'http_error-log'] && Lower(evt.Meta.http_path) contains '/owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/getphpinfo.php'
groupby: "evt.Meta.source_ip"
blackhole: 2m
labels:
  type: exploit
  remediation: true
  classification:
    - attack.T1595
    - attack.T1190
    - cve.CVE-2023-49103
  spoofable: 1
  confidence: 2
  behavior: "http:exploit"
  label: "ownCloud CVE-2023-49103"
  service: owncloud
