Rule History

SID: 2035005 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 2 • Jan 28, 2022, 12:00 PM

Message:

ET EXPLOIT Apache Spark RPC - Unauthenticated RegisterApplication Request - RCE Attempt (CVE-2020-9480)

Rule:

alert tcp-pkt any any -> $HOME_NET any (msg:"ET EXPLOIT Apache Spark RPC - Unauthenticated RegisterApplication Request - RCE Attempt (CVE-2020-9480)"; flow:established,to_server; flowbits:set,ET.ApacheSpark_UnauthRegisterApplication; flowbits:isnotset,ET.ApacheSpark_AuthAttempted; flowbits:isnotset,ET.ApacheSpark_CE; content:"org.apache.spark.deploy.DeployMessages$RegisterApplication"; content:"spark.driver.port="; distance:0; pcre:"/^\d+..(?:[\x60\x3b\x7c]|%60|%3b|%7c|%26|(?:[\x3c\x3e\x24]|%3c|%3e|%24)(?:\x28|%28))-XX:OnOutOfMemoryError=/R"; content:"-XX:OnOutOfMemoryError="; fast_pattern; reference:cve,2020-9480; reference:url,www.youtube.com/watch?v=EAzdGo-i8vE; reference:url,github.com/ayoul3/sparky/; classtype:attempted-admin; sid:2035005; rev:2; metadata:attack_target Server, created_at 2022_01_28, cve CVE_2020_9480, deployment Internal, deployment Datacenter, confidence High, signature_severity Major, updated_at 2022_01_28;)

Created:

Jan 28, 2022, 12:00 PM

Updated:

Jan 28, 2022, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

Sep 21, 2024, 3:00 AM

Filename:

rules/emerging-exploit.rules