Update citrix_sharefile_exploitation_cve_2023_24489.yml

detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml

@@ -14,11 +14,11 @@ description: The following analytic detects a potentially malicious file upload
 
   However, it's important to note that false positives may occur. For example, legitimate but uncommon file uploads might match these URL patterns. It's crucial to verify any alerts generated by this analytic to ensure accurate threat detection. This analytic provides critical insights into potential attack attempts and assists in maintaining the integrity and security of enterprise content management systems like Documentum.
 search: '| tstats count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Web where Web.url IN ("/documentum/upload.aspx?parentid=*","*/documentum/upload.aspx?filename=*","*/documentum/upload.aspx?uploadId=*")  Web.http_method=POST 
+  as lastTime from datamodel=Web where Web.url="/documentum/upload.aspx?*" AND Web.url IN ("*parentid=*","*filename=*","*uploadId=*") AND Web.url IN ("*unzip=*", "*raw=*") Web.http_method=POST 
   by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
   | `drop_dm_object_name("Web")`
   | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` | `citrix_sharefile_exploitation_cve_2023_24489_filter`'
+  | `security_content_ctime(lastTime)`| `citrix_sharefile_exploitation_cve_2023_24489_filter`'
 how_to_implement: Dependent upon the placement of the ShareFile application, ensure the latest Technology Add-On is eneabled. This detection requires the Web datamodel to be populated from a
   supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk
   for Palo Alto.