Guacamole Two Users Sharing Session Anomaly

Title: Guacamole Two Users Sharing Session Anomaly
Status: test
Description:Detects suspicious session with two users present
References:
  -https://research.checkpoint.com/2020/apache-guacamole-rce/
Author: Florian Roth (Nextron Systems)
Date: 2020-07-03
modified:2021-11-27
Tags:

• -'attack.credential-access'
• -'attack.t1212'

Logsource:

• product: linux
• service: guacamole

Detection:
  selection:
    - '(2 users now present)'
  condition:selection
Falsepositives:
  -Unknown
Level: high