type: trigger
#debug: true
name: crowdsecurity/CVE-2017-9841
description: "Detect CVE-2017-9841 exploits"
filter: |
    evt.Meta.log_type == 'http_access-log' &&
    Lower(evt.Meta.http_path) endsWith 'util/php/eval-stdin.php'
blackhole: 1m
groupby: "evt.Meta.source_ip"
labels:
  type: exploit
  remediation: true
  classification:
    - attack.T1595
    - attack.T1190
    - cve.CVE-2017-9841
  spoofable: 0
  confidence: 3
  behavior: "http:exploit"
  label: "PHP Unit Test Framework CVE-2017-9841"
  service: PHP
