[CISCO-IOS] WebUI Accessed by any user

alert any $HOME_NET any -> $HOME_NET any (msg:"[CISCO-IOS] WebUI Accessed by any user"; content:"%SYS-5-CONFIG_P
| 3a
| "; content:"process SEP_webui_wsma_http"; reference:cve,2023-20198; reference:url,www.cisco.com/c/en/us/support/docs/csa/cisco-sa-iosxe-webui-privesc-j22SaA4z.html; reference:url,blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/; classtype:targeted-activity; sid:5013941; rev:1; metadata:deployment Server,affected_product cisco_ios_xe,affected_version all,mitigation www.cisco.com/c/en/us/support/docs/csa/cisco-sa-iosxe-webui-privesc-j22SaA4z.html,deprecation_reason NONE,tag cve, created_at 2023_10_17, updated_at 2023_10_17, mitre_tactic_id TA0004, mitre_technique_id T1068;)