title: TerraMaster TOS CVE-2020-28188
id: 15c312b9-00d0-4feb-8870-7d940a4bdc5e
status: test
description: Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188
references:
    - https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
    - https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/
author: Bhabesh Raj
date: 2021-01-25
modified: 2023-01-02
tags:
    - attack.t1190
    - attack.initial-access
    - cve.2020-28188
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    base_url:
        cs-method: 'GET'
        cs-uri-query|contains|all:
            - '/include/makecvs.php'
            - '?Event='
    payload:
        cs-uri-query|contains:
            - 'curl'
            - 'wget'
            - '.py'
            - '.sh'
            - 'chmod'
            - '_GET'
    condition: base_url and payload
falsepositives:
    - Unknown
level: high