alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Cacti Unauthenticated RCE Inbound M2 (CVE-2022-46169)"; flow:established,to_server; http.method; content:"GET"; http.header_names; content:"|0d 0a|X-Forwarded-For|0d 0a|"; http.uri.raw; content:"/remote_agent.php?"; content:"action=polldata"; content:"local_data_ids|5b 5d 3d|"; fast_pattern; content:"host_id="; content:"poller_id|3d|"; pcre:"/^(?:[\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|(?:[\x3c\x3e\x24]|%3c|%3e|%24)(?:\x28|%28))/Ri"; reference:url,github.com/taythebot/CVE-2022-46169; reference:cve,2022-46169; classtype:attempted-admin; sid:2043011; rev:1; metadata:attack_target Server, created_at 2022_12_26, cve CVE_2022_46169, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2022_12_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)