alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Zoho ManageEngine ServiceDesk Plus Authentication Bypass (CVE-2021-37415)"; flow:established,to_server; http.uri; content:"/api/v3/"; fast_pattern; pcre:"/(?:(?:\x2e|%+(?:25)*2[Ee]|%+(?:25)*32%+(?:25)*[46]5|%+[cC]0%+[aA][eE]){1,2}(?:\x2f|\x5c|%+(?:25)*5[Cc]|%+(?:25)*2[Ff]|%+[cC]0%+[aA][fF]){1,})+api\x2fv3\x2f/"; http.header; content:!"authorization|3a 20|"; nocase; reference:url,nvd.nist.gov/vuln/detail/CVE-2021-37415; reference:cve,2021-37415; classtype:web-application-attack; sid:2066201; rev:3; metadata:affected_product Zoho_ManageEngine, attack_target Server, tls_state TLSDecrypt, created_at 2025_12_09, cve CVE_2021_37415, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Exploit, updated_at 2026_11_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)