Sid 1-60120

Rule Documentation
References

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Kaseya VSA ManagedITSync arbitrary SQL command execution attempt

Rule Explanation

This rule looks for arbitrary SQL commands sent to the /KaseyaCwWebService/ManagedIT.asmx endpoint on Kaseya VSA web servers.

What To Look For

This rule looks for attempts to execute arbitrary SQL commands on a Kaseya VSA web server.

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic: Initial Access

Technique: Exploit Public-Facing Application

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

Rule Vulnerability

SQL Injection

SQL Injection attacks target PHP and ASP applications primarily and involve SQL queries or commands added to unverified user input. A successful attack can lead to data leaks (entirely exposed data), database modification (data deletion or tampering), administrative permissions misuse, and sometimes direct commands passed to the operating system.