{"id":"T1190","name":"Exploit Public-Facing Application","url":"https://attack.mitre.org/techniques/T1190","tactics":["initial-access"],"platforms":["Containers","ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0080","stix_id":"x-mitre-detection-strategy--dd8477c8-2aad-4db3-b810-fe0d2f605fa8","name":"Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)","url":"https://attack.mitre.org/detectionstrategies/DET0080","analytics":[{"id":"AN0219","stix_id":"x-mitre-analytic--17290910-5b25-477a-a0c0-c2661ff2585e","name":"Analytic 0219","description":"Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.","url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0219","platforms":["Windows"],"log_source_references":[{"name":"ApplicationLog:IIS","channel":"IIS W3C logs in C:\\inetpub\\logs\\LogFiles\\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns)","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"applicationlog-iis"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"PublicVIPs","description":"List of public IPs/hostnames that front apps; used to scope web log and Zeek/proxy data."},{"field":"SuspiciousPatterns","description":"Regex set for exploit-like inputs (../, union select, cmd=, ${jndi:, rO0AB (Java serialization), %00, ${env:}, ${${::-j}ndi})."},{"field":"ErrorRateThreshold","description":"Spike threshold for HTTP status 5xx/4xx per client or URI (e.g., >5 in 5m)."},{"field":"TimeWindow","description":"Correlation horizon between request, error, process spawn, and egress (e.g., 15 minutes)."},{"field":"AllowedChildList","description":"Known child processes of app pools (e.g., msbuild.exe in CI) to reduce false positives."}],"live":true,"detection_strategies":["DET0080"],"techniques":["T1190"]},{"id":"AN0220","stix_id":"x-mitre-analytic--a4ce8f28-db09-4b0d-bb8d-a77ba3cef3c0","name":"Analytic 0220","description":"Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.","url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0220","platforms":["Linux"],"log_source_references":[{"name":"ApplicationLog:WebServer","channel":"/var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"applicationlog-webserver"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"HTTP payloads with SQLi/LFI/JNDI/deserialization indicators","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"WebProcList","description":"server/interpreter names to watch (apache2, httpd, nginx, php-fpm, uwsgi, gunicorn, node)."},{"field":"ChildToolList","description":"post-exploitation binaries (sh, bash, curl, wget, python, perl, socat, nc)."},{"field":"BurstThreshold","description":"Rate of errors/requests per src_ip/uri to flag reconnaissance/exploit spray."},{"field":"TimeWindow","description":"Exec/network correlation window."}],"live":true,"detection_strategies":["DET0080"],"techniques":["T1190"]},{"id":"AN0221","stix_id":"x-mitre-analytic--ddab6d30-7e37-462e-b183-39c7ceb2b986","name":"Analytic 0221","description":"Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.","url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0221","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"App/web server logs ingested via unified logging or filebeat (nginx/apache/node).","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"exec events where web process starts a shell/tooling","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"NSM:Flow","channel":"outbound egress from web host after suspicious request","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ServiceList","description":"Names/paths of public daemons on macOS (httpd, nginx, node, java)."},{"field":"TimeWindow","description":"Correlation window for request → exec → egress."}],"live":true,"detection_strategies":["DET0080"],"techniques":["T1190"]},{"id":"AN0222","stix_id":"x-mitre-analytic--a57ad75c-331e-4607-b358-61f4cddb8a5d","name":"Analytic 0222","description":"Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).","url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0222","platforms":["Containers"],"log_source_references":[{"name":"ApplicationLog:Ingress","channel":"Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"applicationlog-ingress"},{"name":"docker:events","channel":"Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"docker-events"},{"name":"NSM:Flow","channel":"Requests towards cloud metadata or command & control from pod IPs","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"IngressNamespaces","description":"Namespaces that are Internet-facing."},{"field":"MetadataEndpoints","description":"Cloud metadata IPs/hostnames for exfil of credentials."},{"field":"TimeWindow","description":"Join period between ingress request and pod exec/egress."}],"live":true,"detection_strategies":["DET0080"],"techniques":["T1190"]},{"id":"AN0223","stix_id":"x-mitre-analytic--17f9487f-711d-4f28-9de8-209ae39d33d2","name":"Analytic 0223","description":"Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.","url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0223","platforms":["IaaS"],"log_source_references":[{"name":"ALB:HTTPLogs","channel":"AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"alb-httplogs"},{"name":"AWS:VPCFlowLogs","channel":"VPC/NSG flow logs for pod/instance egress to Internet or metadata","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"aws-vpcflowlogs"}],"mutable_elements":[{"field":"LBProjects","description":"Cloud accounts/subscriptions/regions to include."},{"field":"ErrorBurst","description":"5xx/4xx per client threshold."}],"live":true,"detection_strategies":["DET0080"],"techniques":["T1190"]},{"id":"AN0224","stix_id":"x-mitre-analytic--0668f39a-d319-427f-b29b-160399e6f79a","name":"Analytic 0224","description":"Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.","url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0224","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"/var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"esxi-hostd"},{"name":"NSM:Flow","channel":"Connections to TCP 427 (SLP) or vCenter web services from untrusted sources","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"MgmtCIDR","description":"Only trusted admin networks should reach ESXi/vCenter."},{"field":"TimeWindow","description":"Join errors and inbound flows."}],"live":true,"detection_strategies":["DET0080"],"techniques":["T1190"]},{"id":"AN0225","stix_id":"x-mitre-analytic--72298803-0644-477f-be89-01b173202577","name":"Analytic 0225","description":"Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.","url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0225","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:controlplane","channel":"Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"networkdevice-controlplane"},{"name":"NSM:Flow","channel":"NetFlow/sFlow for odd egress to Internet from mgmt plane","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"MgmtPorts","description":"List of admin services to watch (8443, 443, 161/udp, 4786, 22)."},{"field":"TrustedAdmins","description":"Admin source ranges to allow."}],"live":true,"detection_strategies":["DET0080"],"techniques":["T1190"]}],"live":true,"version":"1.0","techniques":["T1190"]}],"sigma_rules":[{"id":"043c1609-0e32-4462-a6f2-5a0c2da3fafe","title":"Potential CVE-2023-25717 Exploitation Attempt","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-05-30","modified":null,"description":"Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin","references":["https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2023-25717","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-25717/web_cve_2023_25717_ruckus_wireless_admin_exploit_attempt.yml","techniques":["T1190"],"cves":["CVE-2023-25717"]},{"id":"0bbcd74b-0596-41a4-94a0-4e88a76ffdb3","title":"Potential CVE-2021-27905 Exploitation Attempt","author":"@gott_cyber","status":"test","level":"medium","date":"2022-12-11","modified":"2023-03-24","description":"Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.","references":["https://twitter.com/Al1ex4/status/1382981479727128580","https://twitter.com/sec715/status/1373472323538362371","https://nsfocusglobal.com/apache-solr-arbitrary-file-read-and-ssrf-vulnerability-threat-alert/","https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247484117&idx=1&sn=2fdab8cbe4b873f8dd8abb35d935d186","https://github.com/murataydemir/CVE-2021-27905"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-27905","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-27905/web_cve_2021_27905_apache_solr_exploit.yml","techniques":["T1190"],"cves":["CVE-2021-27905"]},{"id":"0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7","title":"Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2020-07-10","modified":"2023-01-02","description":"Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195","references":["https://support.citrix.com/article/CTX276688","https://research.nccgroup.com/2020/07/10/rift-citrix-adc-vulnerabilities-cve-2020-8193-cve-2020-8195-and-cve-2020-8196-intelligence/","https://dmaasland.github.io/posts/citrix.html"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2020-8193","cve.2020-8195","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-8193/web_cve_2020_8193_8195_citrix_exploit.yml","techniques":["T1190"],"cves":["CVE-2020-8193","CVE-2020-8195"]},{"id":"0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a","title":"Ruby on Rails Framework Exceptions","author":"Thomas Patzke","status":"stable","level":"medium","date":"2017-08-06","modified":"2020-09-01","description":"Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts","references":["http://edgeguides.rubyonrails.org/security.html","http://guides.rubyonrails.org/action_controller_overview.html","https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception","https://github.com/rails/rails/blob/cd08e6bcc4cd8948fe01e0be1ea0c7ca60373a25/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb"],"logsource":{"product":"ruby_on_rails","category":"application"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/application/ruby/appframework_ruby_on_rails_exceptions.yml","techniques":["T1190"],"cves":[]},{"id":"0e1ebc5a-15d0-4bf6-8199-b2535397433a","title":"Potential CVE-2023-23752 Exploitation Attempt","author":"Bhabesh Raj","status":"test","level":"high","date":"2023-02-23","modified":null,"description":"Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla","references":["https://xz.aliyun.com/t/12175","https://twitter.com/momika233/status/1626464189261942786"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2023-23752","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-23752/web_cve_2023_23752_joomla_exploit_attempt.yml","techniques":["T1190"],"cves":["CVE-2023-23752"]},{"id":"0fdc7c7f-c690-4217-9ae3-31f5156eed72","title":"Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)","author":"Nisarg Suthar","status":"experimental","level":"high","date":"2025-08-01","modified":null,"description":"Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.","references":["https://reliaquest.com/blog/threat-spotlight-cve-2025-54309-crushftp-exploit/","https://pwn.guide/free/web/crushftp","https://firecompass.com/crushftp-vulnerability-cve-2025-54309-securing-file-transfer-services/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.initial-access","attack.execution","attack.t1059.001","attack.t1059.003","attack.t1068","attack.t1190","cve.2025-54309","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-54309/proc_creation_win_exploit_cve_2025_54309.yml","techniques":["T1059.001","T1059.003","T1068","T1190"],"cves":["CVE-2025-54309"]},{"id":"1012f107-b8f1-4271-af30-5aed2de89b39","title":"Terminal Service Process Spawn","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-05-22","modified":"2023-01-25","description":"Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)","references":["https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","attack.lateral-movement","attack.t1210","car.2013-07-002"],"path":"rules/windows/process_creation/proc_creation_win_svchost_termserv_proc_spawn.yml","techniques":["T1190","T1210"],"cves":[]},{"id":"14f3f1c8-02d5-43a2-a191-91ffb52d3015","title":"RDS Database Security Group Modification","author":"jamesc-grafana","status":"test","level":"medium","date":"2024-07-11","modified":null,"description":"Detects changes to the security group entries for RDS databases.\nThis can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.\n","references":["https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_rds.yml","techniques":["T1190"],"cves":[]},{"id":"15697955-6a29-47ca-92e9-0e05efae3260","title":"Cisco ASA Exploitation Activity - Proxy","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-20","modified":null,"description":"Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.\n","references":["https://x.com/defusedcyber/status/1971492272966598683"],"logsource":{"category":"proxy"},"tags":["attack.initial-access","attack.t1190","cve.2025-20333","cve.2025-20362","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-20333/proxy_exploit_cve_2025_20333.yml","techniques":["T1190"],"cves":["CVE-2025-20333","CVE-2025-20362"]},{"id":"15c312b9-00d0-4feb-8870-7d940a4bdc5e","title":"TerraMaster TOS CVE-2020-28188","author":"Bhabesh Raj","status":"test","level":"high","date":"2021-01-25","modified":"2023-01-02","description":"Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188","references":["https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/","https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/"],"logsource":{"category":"webserver"},"tags":["attack.t1190","attack.initial-access","cve.2020-28188","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-28188/web_cve_2020_28188_terramaster_rce_exploit.yml","techniques":["T1190"],"cves":["CVE-2020-28188"]},{"id":"16c86189-b556-4ee8-b4c7-7e350a195a4f","title":"Potential Server Side Template Injection In Velocity","author":"Moti Harmats","status":"test","level":"high","date":"2023-02-11","modified":null,"description":"Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.","references":["https://antgarsil.github.io/posts/velocity/","https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs"],"logsource":{"product":"velocity","category":"application"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/application/velocity/velocity_ssti_injection.yml","techniques":["T1190"],"cves":[]},{"id":"179ed852-0f9b-4009-93a7-68475910fd86","title":"CVE-2021-21972 VSphere Exploitation","author":"Bhabesh Raj","status":"test","level":"high","date":"2021-02-24","modified":"2023-01-02","description":"Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972","references":["https://www.vmware.com/security/advisories/VMSA-2021-0002.html","https://f5.pm/go-59627.html","https://swarm.ptsecurity.com/unauth-rce-vmware"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-21972","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-21972/web_cve_2021_21972_vsphere_unauth_rce_exploit.yml","techniques":["T1190"],"cves":["CVE-2021-21972"]},{"id":"181f49fa-0b21-4665-a98c-a57025ebb8c7","title":"Potential OWASSRF Exploitation Attempt - Webserver","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-22","modified":"2023-01-02","description":"Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint","references":["https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/","https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-41082/web_cve_2022_36804_exchange_owassrf_exploitation.yml","techniques":["T1190"],"cves":[]},{"id":"19aa4f58-94ca-45ff-bc34-92e533c0994a","title":"Suspicious User-Agents Related To Recon Tools","author":"Nasreddine Bencherchali (Nextron Systems), Tim Shelton","status":"test","level":"medium","date":"2022-07-19","modified":"2026-06-11","description":"Detects known suspicious (default) user-agents related to scanning/recon tools","references":["https://github.com/commixproject/commix/blob/c7f1447371524427bb30abe731235acc7386153b/src/utils/settings.py#L281","https://github.com/epi052/feroxbuster/blob/ffdf871abe0a358a1531ba4135e208d4dbe8fc31/src/config/utils.rs#L100","https://github.com/ffuf/ffuf/blob/ce3cf6bd733a24d3a9f024305234c1a6298198eb/pkg/runner/simple.go#L130","https://github.com/lanmaster53/recon-ng/blob/9e907dfe09fce2997f0301d746796408e01a60b7/recon/core/base.py#L92","https://github.com/nmap/nmap/blob/2e47fa87469fd358ef64689d2d2de7294e385eb8/nselib/http.lua#L160","https://github.com/OJ/gobuster/blob/d20300cc46096984565e82fb73a45bf8d281b990/libgobuster/helpers.go#L124","https://github.com/sqlmapproject/sqlmap/blob/be216041e2f255ae43b050d466bd5bf92681e665/lib/core/settings.py#L29","https://github.com/sullo/nikto/blob/999670cb6a939b6c93840ce666941756e4c5dcf5/program/plugins/nikto_core.plugin#L3515","https://github.com/urbanadventurer/WhatWeb/blob/d279d93042d034f3fd29d5a893d44ccc0595d3f8/lib/whatweb.rb#L68","https://github.com/wpscanteam/wpscan/blob/4f1ce142b9768044be3e35bd0cddf1052e35efe8/lib/wpscan/browser.rb#L32","https://github.com/xmendez/wfuzz/blob/2263cd0932fef333118cd197656f709141bab615/src/wfuzz/facade.py#L43","https://github.com/zmap/zgrab2/blob/e91fc9860ca6611eb7c6fe7d2fe2be70212a37ba/modules/http/scanner.go#L54"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/web/webserver_generic/web_susp_useragents.yml","techniques":["T1190"],"cves":[]},{"id":"19aefed0-ffd4-47dc-a7fc-f8b1425e84f9","title":"Python SQL Exceptions","author":"Thomas Patzke","status":"stable","level":"medium","date":"2017-08-12","modified":"2020-09-01","description":"Generic rule for SQL exceptions in Python according to PEP 249","references":["https://www.python.org/dev/peps/pep-0249/#exceptions"],"logsource":{"product":"python","category":"application"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/application/python/app_python_sql_exceptions.yml","techniques":["T1190"],"cves":[]},{"id":"1a9a04fd-02d1-465c-abad-d733fd409f9c","title":"Apache Spark Shell Command Injection - Weblogs","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-07-19","modified":"2023-01-02","description":"Detects attempts to exploit an apache spark server via CVE-2014-6287 from a weblogs perspective","references":["https://github.com/W01fh4cker/cve-2022-33891/blob/fd973b56e78bca8822caa3a2e3cf1b5aff5d0950/cve_2022_33891_poc.py","https://sumsec.me/2022/CVE-2022-33891%20Apache%20Spark%20shell%20command%20injection.html","https://github.com/apache/spark/pull/36315/files"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2022-33891","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-33891/web_cve_2022_33891_spark_shell_command_injection.yml","techniques":["T1190"],"cves":["CVE-2022-33891"]},{"id":"1b2eeb27-949b-4704-8bfa-d8e5cfa045a1","title":"Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-01-20","modified":null,"description":"Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877","references":["https://seclists.org/fulldisclosure/2023/Jan/1","https://www.rapid7.com/blog/post/2023/01/19/etr-exploitation-of-control-web-panel-cve-2022-44877/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2022-44877","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-44877/web_cve_2022_44877_exploitation_attempt.yml","techniques":["T1190"],"cves":["CVE-2022-44877"]},{"id":"1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db","title":"CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"medium","date":"2023-11-14","modified":null,"description":"Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.\n","references":["https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html","https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment","https://github.com/ForceFledgling/CVE-2023-22518"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","attack.initial-access","attack.t1190","cve.2023-22518","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_win_exploit_cve_2023_22518_confluence_tomcat_child_proc.yml","techniques":["T1059","T1190"],"cves":["CVE-2023-22518"]},{"id":"1ddf4596-1908-43c9-add2-1d2c2fcc4797","title":"Potential OWASSRF Exploitation Attempt - Proxy","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-22","modified":null,"description":"Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint","references":["https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/","https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/"],"logsource":{"category":"proxy"},"tags":["attack.initial-access","attack.t1190","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-41082/proxy_cve_2022_36804_exchange_owassrf_exploitation.yml","techniques":["T1190"],"cves":[]},{"id":"1f0489be-b496-4ddf-b3a9-5900f2044e9c","title":"Suspicious File Write to SharePoint Layouts Directory","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-07-24","modified":null,"description":"Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation.\nThis behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.\n","references":["https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/","https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.initial-access","attack.t1190","attack.persistence","attack.t1505.003"],"path":"rules/windows/file/file_event/file_event_win_susp_filewrite_in_sharepoint_layouts_dir.yml","techniques":["T1190","T1505.003"],"cves":[]},{"id":"20c6ed1c-f7f0-4ea3-aa65-4f198e6acb0f","title":"Sitecore Pre-Auth RCE CVE-2021-42237","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-11-17","modified":"2023-01-02","description":"Detects exploitation attempts of Sitecore Experience Platform Pre-Auth RCE CVE-2021-42237 found in Report.ashx","references":["https://blog.assetnote.io/2021/11/02/sitecore-rce/","https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-42237","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-42237/web_cve_2021_42237_sitecore_report_ashx.yml","techniques":["T1190"],"cves":["CVE-2021-42237"]},{"id":"21541900-27a9-4454-9c4c-3f0a4240344a","title":"OMIGOD SCX RunAsProvider ExecuteShellCommand","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"test","level":"high","date":"2021-10-15","modified":"2022-10-05","description":"Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.\nSCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including\nMicrosoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.\n","references":["https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure","https://github.com/Azure/Azure-Sentinel/pull/3059"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.privilege-escalation","attack.initial-access","attack.execution","attack.t1068","attack.t1190","attack.t1203"],"path":"rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml","techniques":["T1068","T1190","T1203"],"cves":[]},{"id":"23eee45e-933b-49f9-ae1b-df706d2d52ef","title":"Exchange ProxyShell Pattern","author":"Florian Roth (Nextron Systems), Rich Warren","status":"test","level":"high","date":"2021-08-07","modified":"2023-01-02","description":"Detects URL patterns that could be found in ProxyShell exploitation attempts against Exchange servers (failed and successful)","references":["https://youtu.be/5mqid-7zp8k?t=2231","https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html","https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell.yml","techniques":["T1190"],"cves":[]},{"id":"245f92e3-c4da-45f1-9070-bc552e06db11","title":"Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt","author":"Bhabesh Raj","status":"test","level":"high","date":"2021-09-08","modified":"2023-02-13","description":"Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-26084","https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html","https://github.com/h3v0x/CVE-2021-26084_Confluence"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.execution","attack.t1190","attack.t1059","cve.2021-26084","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-26084/proc_creation_win_exploit_cve_2021_26084_atlassian_confluence.yml","techniques":["T1190","T1059"],"cves":["CVE-2021-26084"]},{"id":"271de298-cc0e-4842-acd8-079a0a99ea65","title":"Windows Suspicious Child Process from Node.js - React2Shell","author":"Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali","status":"experimental","level":"high","date":"2025-12-05","modified":null,"description":"Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell).\nAttackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync().\nIf execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked.\nFor other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.\n","references":["https://github.com/msanft/CVE-2025-55182","https://nodejs.org/api/child_process.html#class-childprocess","https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870","https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","attack.initial-access","attack.t1190","detection.emerging-threats","cve.2025-55182"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_win_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml","techniques":["T1059","T1190"],"cves":["CVE-2025-55182"]},{"id":"27d2cdde-9778-490e-91ec-9bd0be6e8cc6","title":"CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"medium","date":"2023-11-14","modified":null,"description":"Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.\n","references":["https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html","https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment","https://github.com/ForceFledgling/CVE-2023-22518"],"logsource":{"category":"proxy"},"tags":["attack.initial-access","attack.t1190","cve.2023-22518","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-22518/proxy_exploit_cve_2023_22518_confluence_auth_bypass.yml","techniques":["T1190"],"cves":["CVE-2023-22518"]},{"id":"2dbc10d7-a797-49a8-8776-49efa6442e60","title":"Pulse Secure Attack CVE-2019-11510","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2019-11-18","modified":"2023-01-02","description":"Detects CVE-2019-11510 exploitation attempt - URI contains Guacamole","references":["https://www.exploit-db.com/exploits/47297"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2019-11510","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Exploits/CVE-2019-11510/web_cve_2019_11510_pulsesecure_exploit.yml","techniques":["T1190"],"cves":["CVE-2019-11510"]},{"id":"3007fec6-e761-4319-91af-e32e20ac43f5","title":"CVE-2021-41773 Exploitation Attempt","author":"daffainfo, Florian Roth","status":"test","level":"high","date":"2021-10-05","modified":"2023-01-02","description":"Detects exploitation of flaw in path normalization in Apache HTTP server 2.4.49.\nAn attacker could use a path traversal attack to map URLs to files outside the expected document root.\nIf files outside of the document root are not protected by \"require all denied\" these requests can succeed.\nAdditionally this flaw could leak the source of interpreted files like CGI scripts.\nThis issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-41773","https://github.com/apache/httpd/commit/e150697086e70c552b2588f369f2d17815cb1782","https://twitter.com/ptswarm/status/1445376079548624899","https://twitter.com/h4x0r_dz/status/1445401960371429381","https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/cves/2021/CVE-2021-41773.yaml","https://twitter.com/bl4sty/status/1445462677824761878"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-41773","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-41773/web_cve_2021_41773_apache_path_traversal.yml","techniques":["T1190"],"cves":["CVE-2021-41773"]},{"id":"31e4e649-7394-4fd2-9ae7-dbc61eebb550","title":"Potential CVE-2023-27997 Exploitation Indicators","author":"Sergio Palacios Dominguez, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-07-28","modified":null,"description":"Detects indicators of potential exploitation of CVE-2023-27997 in Frotigate weblogs.\nTo avoid false positives it is best to look for successive requests to the endpoints mentioned as well as weird values of the \"enc\" parameter\n","references":["https://blog.lexfo.fr/Forensics-xortigate-notice.html","https://blog.lexfo.fr/xortigate-cve-2023-27997.html","https://research.kudelskisecurity.com/2023/06/12/cve-2023-27997-fortigate-ssl-vpn/","https://labs.watchtowr.com/xortigate-or-cve-2023-27997/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2023-27997","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-27997/web_cve_2023_27997_pre_authentication_rce.yml","techniques":["T1190"],"cves":["CVE-2023-27997"]},{"id":"377f33a1-4b36-4ee1-acee-1dbe4b43cfbe","title":"Suspicious VSFTPD Error Messages","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2017-07-05","modified":"2021-11-27","description":"Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts","references":["https://github.com/dagwieers/vsftpd/"],"logsource":{"product":"linux","service":"vsftpd"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml","techniques":["T1190"],"cves":[]},{"id":"37e8369b-43bb-4bf8-83b6-6dd43bda2000","title":"Oracle WebLogic Exploit","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2018-07-22","modified":"2023-01-02","description":"Detects access to a webshell dropped into a keystore folder on the WebLogic server","references":["https://twitter.com/pyn3rd/status/1020620932967223296","https://github.com/LandGrey/CVE-2018-2894"],"logsource":{"category":"webserver"},"tags":["attack.t1190","attack.initial-access","attack.persistence","attack.t1505.003","cve.2018-2894","detection.emerging-threats"],"path":"rules-emerging-threats/2018/Exploits/CVE-2018-2894/web_cve_2018_2894_weblogic_exploit.yml","techniques":["T1190","T1505.003"],"cves":["CVE-2018-2894"]},{"id":"38825179-3c78-4fed-b222-2e2166b926b1","title":"Potential CVE-2021-26084 Exploitation Attempt","author":"Sittikorn S, Nuttakorn T","status":"test","level":"high","date":"2022-12-13","modified":"2023-03-24","description":"Detects potential exploitation of CVE-2021-260841 a Confluence RCE using OGNL injection","references":["https://github.com/TesterCC/exp_poc_library/blob/be61622600ec79d8fba2fa5f816a870715f0cb3b/exp_poc/CVE-2021-26084_Confluence_OGNL_injection/CVE-2021-26084.md","https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md","https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html","https://mraddon.blog/2017/03/20/confluence-trick-to-create-pages-from-blueprint-templates/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-26084","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-26084/web_cve_2021_26084_confluence_rce_exploit.yml","techniques":["T1190"],"cves":["CVE-2021-26084"]},{"id":"3eb91f0a-0060-424a-a676-59f5fdd75610","title":"Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon","author":"@kostastsale","status":"test","level":"high","date":"2022-01-14","modified":null,"description":"Detects potential initial exploitation attempts against VMware Horizon deployments running a vulnerable versions of Log4j.\n","references":["https://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability","https://twitter.com/TheDFIRReport/status/1482078434327244805","https://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","cve.2021-44228","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-44228/proc_creation_win_exploit_cve_2021_44228_vmware_horizon_log4j.yml","techniques":["T1190"],"cves":["CVE-2021-44228"]},{"id":"412d55bc-7737-4d25-9542-5b396867ce55","title":"JNDIExploit Pattern","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-12-12","modified":"2022-12-25","description":"Detects exploitation attempt using the JNDI-Exploit-Kit","references":["https://github.com/pimps/JNDI-Exploit-Kit","https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/web/webserver_generic/web_jndi_exploit.yml","techniques":["T1190"],"cves":[]},{"id":"41956f7c-7a6b-46d6-b6bb-da6eb2e83fbe","title":"Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-05-20","modified":null,"description":"Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0.\nCVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass,\nwhich can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through\ntemplate injection. This sequence enables unauthenticated remote code execution, significantly increasing\nthe impact of exploitation.\n","references":["https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/?123"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","attack.execution","attack.t1203","cve.2025-4427","cve.2025-4428","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-4427/web_invanti_epmm_cve_2025_4427_and_cve_2025_4428.yml","techniques":["T1190","T1203"],"cves":["CVE-2025-4427","CVE-2025-4428"]},{"id":"43259cc4-1b80-4931-bd98-baea01afc196","title":"Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process","author":"Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-10-31","modified":null,"description":"Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe.\nThis behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.\n","references":["https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/","https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability","https://hawktrace.com/blog/CVE-2025-59287-UNAUTH"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.t1190","attack.t1203","cve.2025-59287","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-59287/proc_creation_win_exploit_cve_2025_59287.yml","techniques":["T1190","T1203"],"cves":["CVE-2025-59287"]},{"id":"44b53b1c-e60f-4a7b-948e-3435a7918478","title":"CVE-2020-5902 F5 BIG-IP Exploitation Attempt","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2020-07-05","modified":"2023-01-02","description":"Detects the exploitation attempt of the vulnerability found in F5 BIG-IP and described in CVE-2020-5902","references":["https://support.f5.com/csp/article/K52145254","https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/","https://twitter.com/yorickkoster/status/1279709009151434754","https://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2020-5902","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-5902/web_cve_2020_5902_f5_bigip.yml","techniques":["T1190"],"cves":["CVE-2020-5902"]},{"id":"459628e3-1b00-4e9b-9e5b-7da8961aea35","title":"Suspicious CrushFTP Child Process","author":"Craig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-04-10","modified":null,"description":"Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as\nCVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests.\nThe detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.\n","references":["https://nvd.nist.gov/vuln/detail/CVE-2025-2825","https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update","https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/","https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis","https://projectdiscovery.io/blog/crushftp-authentication-bypass"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.execution","attack.t1059.001","attack.t1059.003","attack.t1190","cve.2025-31161","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml","techniques":["T1059.001","T1059.003","T1190"],"cves":["CVE-2025-31161"]},{"id":"48d053db-6a56-4866-b60d-0975647050ed","title":"SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-07-21","modified":null,"description":"Detects access to vulnerable SharePoint components potentially being exploited in CVE-2025-53770 through IIS web server logs.\nCVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.\n","references":["https://www.linkedin.com/posts/mauricefielenbach_sharepoint-incidentresponse-windowssecurity-activity-7352653907363303425-bL2f","https://research.eye.security/sharepoint-under-siege/","https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2025-53770","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-53770/web_win_iis_exploit_cve_2025_53770.yml","techniques":["T1190"],"cves":["CVE-2025-53770"]},{"id":"4d0af518-828e-4a04-a751-a7d03f3046ad","title":"Potential OGNL Injection Exploitation In JVM Based Application","author":"Moti Harmats","status":"test","level":"high","date":"2023-02-11","modified":null,"description":"Detects potential OGNL Injection exploitation, which may lead to RCE.\nOGNL is an expression language that is supported in many JVM based systems.\nOGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)\n","references":["https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs"],"logsource":{"product":"jvm","category":"application"},"tags":["attack.initial-access","attack.t1190","cve.2017-5638","cve.2022-26134"],"path":"rules/application/jvm/java_ognl_injection_exploitation_attempt.yml","techniques":["T1190"],"cves":["CVE-2017-5638","CVE-2022-26134"]},{"id":"5513deaf-f49a-46c2-a6c8-3f111b5cb453","title":"SQL Injection Strings In URI","author":"Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank)","status":"test","level":"high","date":"2020-02-22","modified":"2023-09-04","description":"Detects potential SQL injection attempts via GET requests in access logs.","references":["https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/","https://www.acunetix.com/blog/articles/using-logs-to-investigate-a-web-application-attack/","https://brightsec.com/blog/sql-injection-payloads/","https://github.com/payloadbox/sql-injection-payload-list","https://book.hacktricks.xyz/pentesting-web/sql-injection/mysql-injection"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/web/webserver_generic/web_sql_injection_in_access_logs.yml","techniques":["T1190"],"cves":[]},{"id":"5525edac-f599-4bfd-b926-3fa69860e766","title":"Pulse Connect Secure RCE Attack CVE-2021-22893","author":"Sittikorn S","status":"stable","level":"high","date":"2021-06-29","modified":"2023-01-02","description":"This rule detects exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893)","references":["https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-22893","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-22893/web_cve_2021_22893_pulse_secure_rce_exploit.yml","techniques":["T1190"],"cves":["CVE-2021-22893"]},{"id":"5660d8db-6e25-411f-b92f-094420168a5d","title":"Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution","author":"@kostastsale","status":"test","level":"medium","date":"2022-04-25","modified":null,"description":"Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager.\nAs reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat \"prunsrv.exe\" process application.\n","references":["https://blog.morphisec.com/vmware-identity-manager-attack-backdoor","https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.t1059.006","attack.t1190","cve.2022-22954","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-22954/proc_creation_win_exploit_cve_2022_22954_vmware_workspace_one_rce.yml","techniques":["T1059.006","T1190"],"cves":["CVE-2022-22954"]},{"id":"56973b50-3382-4b56-bdf5-f51a3183797a","title":"CVE-2021-33766 Exchange ProxyToken Exploitation","author":"Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Christian Burkard (Nextron Systems)","status":"test","level":"critical","date":"2021-08-30","modified":"2023-01-02","description":"Detects the exploitation of Microsoft Exchange ProxyToken vulnerability as described in CVE-2021-33766","references":["https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-33766","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-33766/web_cve_2021_33766_msexchange_proxytoken.yml","techniques":["T1190"],"cves":["CVE-2021-33766"]},{"id":"583aa0a2-30b1-4d62-8bf3-ab73689efe6c","title":"Java Payload Strings","author":"frack113, Harjot Singh, \"@cyb3rjy0t\" (update)","status":"test","level":"high","date":"2022-06-04","modified":"2023-01-19","description":"Detects possible Java payloads in web access logs","references":["https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/","https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/","https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md","https://twitter.com/httpvoid0x2f/status/1532924261035384832","https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035"],"logsource":{"category":"webserver"},"tags":["cve.2022-26134","cve.2021-26084","attack.initial-access","attack.t1190"],"path":"rules/web/webserver_generic/web_java_payload_in_access_logs.yml","techniques":["T1190"],"cves":["CVE-2022-26134","CVE-2021-26084"]},{"id":"5a35116f-43bc-4901-b62d-ef131f42a9af","title":"CVE-2020-10148 SolarWinds Orion API Auth Bypass","author":"Bhabesh Raj, Tim Shelton","status":"test","level":"critical","date":"2020-12-27","modified":"2023-01-02","description":"Detects CVE-2020-10148 SolarWinds Orion API authentication bypass attempts","references":["https://kb.cert.org/vuls/id/843464"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2020-10148","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-10148/web_cve_2020_10148_solarwinds_exploit.yml","techniques":["T1190"],"cves":["CVE-2020-10148"]},{"id":"5b304bcb-ac33-49d0-87af-fa1b3ca94333","title":"Suspicious Child Process of SAP NetWeaver","author":"Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-04-28","modified":null,"description":"Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential\nexploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.\n","references":["https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/","https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.t1190","attack.persistence","attack.t1059.003","cve.2025-31324","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-31324/proc_creation_win_sap_netweaver_susp_child_process.yml","techniques":["T1190","T1059.003"],"cves":["CVE-2025-31324"]},{"id":"5b91409c-cb18-4ab6-ac75-c5759f998409","title":"Potential SAP NetWeaver Webshell Creation - Linux","author":"Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-04-28","modified":null,"description":"Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories,\nwhich may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.\n","references":["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324","https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/","https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/"],"logsource":{"product":"linux","category":"file_event"},"tags":["attack.execution","attack.initial-access","attack.t1190","attack.persistence","attack.t1059.003","cve.2025-31324","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_lnx_sap_netweaver_webshell_creation.yml","techniques":["T1190","T1059.003"],"cves":["CVE-2025-31324"]},{"id":"5cc2cda8-f261-4d88-a2de-e9e193c86716","title":"Suspicious Processes Spawned by WinRM","author":"Andreas Hunkeler (@Karneades), Markus Neis","status":"test","level":"high","date":"2021-05-20","modified":"2022-07-14","description":"Detects suspicious processes including shells spawnd from WinRM host process","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.t1190","attack.initial-access","attack.persistence","attack.privilege-escalation"],"path":"rules/windows/process_creation/proc_creation_win_winrm_susp_child_process.yml","techniques":["T1190"],"cves":[]},{"id":"5ea8faa8-db8b-45be-89b0-151b84c82702","title":"Log4j RCE CVE-2021-44228 Generic","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-12-10","modified":"2022-02-06","description":"Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 (Log4Shell)","references":["https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/","https://news.ycombinator.com/item?id=29504755","https://github.com/tangxiaofeng7/apache-log4j-poc","https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b","https://github.com/YfryTchsGD/Log4jAttackSurface","https://twitter.com/shutingrz/status/1469255861394866177?s=21"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j.yml","techniques":["T1190"],"cves":[]},{"id":"65c0a0ab-d675-4441-bd6b-d3db226a2685","title":"Atlassian Bitbucket Command Injection Via Archive API","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-29","modified":"2023-01-02","description":"Detects attempts to exploit the Atlassian Bitbucket Command Injection CVE-2022-36804","references":["https://twitter.com/_0xf4n9x_/status/1572052954538192901","https://www.rapid7.com/blog/post/2022/09/20/cve-2022-36804-easily-exploitable-vulnerability-in-atlassian-bitbucket-server-and-data-center/","https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24-1155489835.html","https://blog.assetnote.io/2022/09/14/rce-in-bitbucket-server/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2022-36804","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-36804/web_cve_2022_36804_atlassian_bitbucket_command_injection.yml","techniques":["T1190"],"cves":["CVE-2022-36804"]},{"id":"6702b13c-e421-44cc-ab33-42cc25570f11","title":"ADSelfService Exploitation","author":"Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems)","status":"test","level":"high","date":"2021-09-20","modified":"2023-01-02","description":"Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSelfService vulnerability CVE-2021-40539","references":["https://us-cert.cisa.gov/ncas/alerts/aa21-259a"],"logsource":{"category":"webserver"},"tags":["cve.2021-40539","detection.emerging-threats","attack.initial-access","attack.t1190"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_adselfservice.yml","techniques":["T1190"],"cves":["CVE-2021-40539"]},{"id":"67bce556-312f-4c81-9162-c3c9ff2599b2","title":"Exchange Exploitation Used by HAFNIUM","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-03-03","modified":"2023-01-02","description":"Detects exploitation attempts in Exchange server logs as described in blog posts reporting on HAFNIUM group activity","references":["https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/","https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","attack.g0125","detection.emerging-threats"],"path":"rules-emerging-threats/2021/TA/HAFNIUM/web_exchange_exploitation_hafnium.yml","techniques":["T1190"],"cves":[]},{"id":"687f6504-7f44-4549-91fc-f07bab065821","title":"Oracle WebLogic Exploit CVE-2021-2109","author":"Bhabesh Raj","status":"test","level":"critical","date":"2021-01-20","modified":"2023-01-02","description":"Detects the exploitation of the WebLogic server vulnerability described in CVE-2021-2109","references":["https://twitter.com/pyn3rd/status/1351696768065409026","https://mp.weixin.qq.com/s/wX9TMXl1KVWwB_k6EZOklw"],"logsource":{"category":"webserver"},"tags":["attack.t1190","attack.initial-access","cve.2021-2109","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-2109/web_cve_2021_2109_weblogic_rce_exploit.yml","techniques":["T1190"],"cves":["CVE-2021-2109"]},{"id":"6991bc2b-ae2e-447f-bc55-3a1ba04c14e5","title":"OpenCanary - FTP Login Attempt","author":"Security Onion Solutions","status":"test","level":"high","date":"2024-03-08","modified":null,"description":"Detects instances where an FTP service on an OpenCanary node has had a login attempt.","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.initial-access","attack.exfiltration","attack.lateral-movement","attack.t1190","attack.t1021"],"path":"rules/application/opencanary/opencanary_ftp_login_attempt.yml","techniques":["T1190","T1021"],"cves":[]},{"id":"69dea60b-2deb-4c9e-a685-ad542f4367f9","title":"Suspicious Child Process of SAP NetWeaver - Linux","author":"Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-04-28","modified":null,"description":"Detects suspicious child processes spawned by SAP NetWeaver on Linux systems that could indicate potential\nexploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.\n","references":["https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/","https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.t1190","attack.persistence","attack.t1059.003","cve.2025-31324","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-31324/proc_creation_lnx_sap_netweaver_susp_child_process.yml","techniques":["T1190","T1059.003"],"cves":["CVE-2025-31324"]},{"id":"6b269392-9eba-40b5-acb6-55c882b20ba6","title":"Suspicious File Drop by Exchange","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-10-04","modified":null,"description":"Detects suspicious file type dropped by an Exchange component in IIS","references":["https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/","https://www.gteltsc.vn/blog/canh-bao-chien-dich-tan-cong-su-dung-lo-hong-zero-day-tren-microsoft-exchange-server-12714.html","https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.persistence","attack.t1190","attack.initial-access","attack.t1505.003"],"path":"rules/windows/file/file_event/file_event_win_exchange_webshell_drop_suspicious.yml","techniques":["T1190","T1505.003"],"cves":[]},{"id":"6c76b3d0-afe4-4870-9443-ffe6773c5fef","title":"Potential Exploitation of GoAnywhere MFT Vulnerability","author":"MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-10-07","modified":null,"description":"Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035.\nThis behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.\n","references":["https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","attack.execution","attack.t1059.001","attack.persistence","attack.t1133","detection.emerging-threats","cve.2025-10035"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-10035/proc_creation_win_exploit_cve_2025_10035.yml","techniques":["T1190","T1059.001","T1133"],"cves":["CVE-2025-10035"]},{"id":"6c7defa9-69f8-4c34-b815-41fce3931754","title":"CVE-2023-1389 Potential Exploitation Attempt - Unauthenticated Command Injection In TP-Link Archer AX21","author":"Nasreddine Bencherchali (Nextron Systems), Rohit Jain","status":"test","level":"medium","date":"2024-06-25","modified":null,"description":"Detects potential exploitation attempt of CVE-2023-1389 an Unauthenticated Command Injection in TP-Link Archer AX21.\n","references":["https://www.tenable.com/security/research/tra-2023-11","https://github.com/Voyag3r-Security/CVE-2023-1389/blob/4ecada7335b17bf543c0e33b2c9fb6b6215c09ae/archer-rev-shell.py","https://www.zerodayinitiative.com/blog/2023/4/21/tp-link-wan-side-vulnerability-cve-2023-1389-added-to-the-mirai-botnet-arsenal"],"logsource":{"category":"proxy"},"tags":["attack.initial-access","attack.t1190","cve.2023-1389","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-1389/proxy_exploit_cve_2023_1389_unauth_command_injection_tplink_archer_ax21.yml","techniques":["T1190"],"cves":["CVE-2023-1389"]},{"id":"6d5b8176-d87d-4402-8af4-53aee9db7b5d","title":"Potential Exploitation Attempt Of Undocumented WindowsServer RCE","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali","status":"test","level":"high","date":"2023-01-21","modified":null,"description":"Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)","references":["https://github.com/SigmaHQ/sigma/pull/3946","https://twitter.com/hackerfantastic/status/1616455335203438592?s=20"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/Windows-Server-Unknown-Exploit/proc_creation_win_exploit_other_win_server_undocumented_rce.yml","techniques":["T1190"],"cves":[]},{"id":"6eea1bf6-f8d2-488a-a742-e6ef6c1b67db","title":"OMIGOD SCX RunAsProvider ExecuteScript","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"test","level":"high","date":"2021-10-15","modified":"2022-10-05","description":"Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell.\nScript being executed gets created as a temp file in /tmp folder with a scx* prefix.\nThen it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/.\nThe file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including\nMicrosoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.\n","references":["https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure","https://github.com/Azure/Azure-Sentinel/pull/3059"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.privilege-escalation","attack.initial-access","attack.execution","attack.t1068","attack.t1190","attack.t1203"],"path":"rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executescript.yml","techniques":["T1068","T1190","T1203"],"cves":[]},{"id":"6f55f047-112b-4101-ad32-43913f52db46","title":"SonicWall SSL/VPN Jarrewrite Exploitation","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-01-25","modified":"2023-04-27","description":"Detects exploitation attempts of the SonicWall Jarrewrite Exploit","references":["https://web.archive.org/web/20210126045316/https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/","https://github.com/darrenmartyn/VisualDoor"],"logsource":{"category":"webserver"},"tags":["attack.t1190","attack.initial-access","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/VisualDoor-Exploit/web_sonicwall_jarrewrite_exploit.yml","techniques":["T1190"],"cves":[]},{"id":"6fb77778-040f-4015-9440-572aa9b6b580","title":"Ingress/Egress Security Group Modification","author":"jamesc-grafana","status":"test","level":"medium","date":"2024-07-11","modified":null,"description":"Detects when an account makes changes to the ingress or egress rules of a security group.\nThis can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server.\n","references":["https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_ingress_egress.yml","techniques":["T1190"],"cves":[]},{"id":"6fd25dd1-527b-47c8-baa4-2a0e77279c6f","title":"RedTail Cryptominer User-Agent","author":"Marco Pedrinazzi (@pedrinazziM) (InTheCyber)","status":"experimental","level":"medium","date":"2026-04-30","modified":null,"description":"Detects inbound web requests using the \"libredtail-http\" User-Agent.\nlibredtail-http is a unique User-Agent string associated with a campaign of automated, malicious scans and attacks targeting exposed container environments and web applications,notably identified in activities stemming from late 2024 through early 2026.\nIt is primarily used by the RedTail cryptominer malware to identify and exploit vulnerabilities for deploying cryptocurrency miners.\n","references":["https://isc.sans.edu/diary/Danger+of+Libredtail+Guest+Diary/32936/","https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/","https://www.cloudsek.com/blog/honey-for-hackers-a-study-of-attacks-targeting-the-recent-cve-2026-21962-and-other-critical-weblogic-vulnerabilities-on-a-high-interactive-oracle-honeypot"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Malware/RedTail-Cryptominer/web_malware_redtail_useragent.yml","techniques":["T1190"],"cves":[]},{"id":"7280c9f3-a5af-45d0-916a-bc01cb4151c9","title":"Suspicious MSExchangeMailboxReplication ASPX Write","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-25","modified":null,"description":"Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation","references":["https://redcanary.com/blog/blackbyte-ransomware/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.initial-access","attack.t1190","attack.persistence","attack.t1505.003"],"path":"rules/windows/file/file_event/file_event_win_susp_exchange_aspx_write.yml","techniques":["T1190","T1505.003"],"cves":[]},{"id":"738cb115-881f-4df3-82cc-56ab02fc5192","title":"Potential CVE-2022-46169 Exploitation Attempt","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-27","modified":"2023-01-02","description":"Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169","references":["https://github.com/0xf4n9x/CVE-2022-46169","https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf","https://github.com/rapid7/metasploit-framework/pull/17407"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2022-46169","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-46169/web_cve_2022_46169_cacti_exploitation_attempt.yml","techniques":["T1190"],"cves":["CVE-2022-46169"]},{"id":"7477881c-ec3b-49d6-aced-7255944e5c59","title":"Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-07-21","modified":null,"description":"Detects potential exploitation of CVE-2025-53770 by identifying indicators such as suspicious command lines discovered in Post-Exploitation activities.\nCVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.\n","references":["https://research.eye.security/sharepoint-under-siege/","https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","cve.2025-53770","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-53770/proc_creation_win_exploit_cve_2025_53770_indicators.yml","techniques":["T1190"],"cves":["CVE-2025-53770"]},{"id":"7745c2ea-24a5-4290-b680-04359cb84b35","title":"Path Traversal Exploitation Attempts","author":"Subhash Popuri (@pbssubhash), Florian Roth (Nextron Systems), Thurein Oo, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2021-09-25","modified":"2023-08-31","description":"Detects path traversal exploitation attempts","references":["https://github.com/projectdiscovery/nuclei-templates","https://book.hacktricks.xyz/pentesting-web/file-inclusion"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/web/webserver_generic/web_path_traversal_exploitation_attempt.yml","techniques":["T1190"],"cves":[]},{"id":"77586a7f-7ea4-4c41-b19c-820140b84ca9","title":"CVE-2021-21978 Exploitation Attempt","author":"Bhabesh Raj","status":"test","level":"high","date":"2020-03-10","modified":"2023-01-02","description":"Detects the exploitation of the VMware View Planner vulnerability described in CVE-2021-21978","references":["https://twitter.com/wugeej/status/1369476795255320580","https://paper.seebug.org/1495/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-21978","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-21978/web_cve_2021_21978_vmware_view_planner_exploit.yml","techniques":["T1190"],"cves":["CVE-2021-21978"]},{"id":"7a4409fc-f8ca-45f6-8006-127d779eaad9","title":"LoadBalancer Security Group Modification","author":"jamesc-grafana","status":"test","level":"medium","date":"2024-07-11","modified":null,"description":"Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB).\nThis can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.\n","references":["https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_loadbalancer.yml","techniques":["T1190"],"cves":[]},{"id":"7b72b328-5708-414f-9a2a-6a6867c26e16","title":"Grafana Path Traversal Exploitation CVE-2021-43798","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2021-12-08","modified":"2023-01-02","description":"Detects a successful Grafana path traversal exploitation","references":["https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/","https://github.com/search?q=CVE-2021-43798"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-43798","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-43798/web_cve_2021_43798_grafana.yml","techniques":["T1190"],"cves":["CVE-2021-43798"]},{"id":"7c64e577-d72e-4c3d-9d75-8de6d1f9146a","title":"CVE-2020-0688 Exploitation Attempt","author":"NVISO","status":"test","level":"high","date":"2020-02-27","modified":"2023-01-02","description":"Detects CVE-2020-0688 Exploitation attempts","references":["https://github.com/Ridter/cve-2020-0688"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2020-0688","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-0688/web_cve_2020_0688_exchange_exploit.yml","techniques":["T1190"],"cves":["CVE-2020-0688"]},{"id":"7cb02516-6d95-4ffc-8eee-162075e111ac","title":"Successful IIS Shortname Fuzzing Scan","author":"frack113","status":"test","level":"medium","date":"2021-10-06","modified":"2023-01-02","description":"When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol \"~\"","references":["https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/fuzzing/iis-shortname.yaml","https://www.exploit-db.com/exploits/19525","https://github.com/lijiejie/IIS_shortname_Scanner"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/web/webserver_generic/web_iis_tilt_shortname_scan.yml","techniques":["T1190"],"cves":[]},{"id":"7dbb86de-a0cc-494c-8aa8-b2996c9ef3c8","title":"LPE InstallerFileTakeOver PoC CVE-2021-41379","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-11-22","modified":"2022-07-12","description":"Detects PoC tool used to exploit LPE vulnerability CVE-2021-41379","references":["https://web.archive.org/web/20220421061949/https://github.com/klinix5/InstallerFileTakeOver"],"logsource":{"product":"windows","service":"application"},"tags":["attack.initial-access","attack.t1190","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-41379/win_vul_cve_2021_41379.yml","techniques":["T1190"],"cves":[]},{"id":"7fb14105-530e-4e2e-8cfb-99f7d8700b66","title":"Atlassian Confluence CVE-2022-26134","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-03","modified":null,"description":"Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134","references":["https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.initial-access","attack.execution","attack.t1190","attack.t1059","cve.2022-26134","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-26134/proc_creation_lnx_exploit_cve_2022_26134_atlassian_confluence.yml","techniques":["T1190","T1059"],"cves":["CVE-2022-26134"]},{"id":"8202070f-edeb-4d31-a010-a26c72ac5600","title":"Suspicious Process By Web Server Process","author":"Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2019-01-16","modified":"2024-11-26","description":"Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation\n","references":["https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.initial-access","attack.t1505.003","attack.t1190"],"path":"rules/windows/process_creation/proc_creation_win_webshell_susp_process_spawned_from_webserver.yml","techniques":["T1505.003","T1190"],"cves":[]},{"id":"846b866e-2a57-46ee-8e16-85fa92759be7","title":"Exploited CVE-2020-10189 Zoho ManageEngine","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2020-03-25","modified":"2023-01-21","description":"Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189","references":["https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html","https://vulmon.com/exploitdetails?qidtp=exploitdb&qid=48224"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","attack.execution","attack.t1059.001","attack.t1059.003","attack.s0190","cve.2020-10189","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-10189/proc_creation_win_exploit_cve_2020_10189.yml","techniques":["T1190","T1059.001","T1059.003"],"cves":["CVE-2020-10189"]},{"id":"85254a62-22be-4239-b79c-2ec17e566c37","title":"F5 BIG-IP iControl Rest API Command Execution - Webserver","author":"Nasreddine Bencherchali (Nextron Systems), Thurein Oo","status":"test","level":"medium","date":"2023-11-08","modified":null,"description":"Detects POST requests to the F5 BIG-IP iControl Rest API \"bash\" endpoint, which allows the execution of commands on the BIG-IP","references":["https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash","https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029","https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516"],"logsource":{"category":"webserver"},"tags":["attack.execution","attack.t1190","attack.initial-access"],"path":"rules/web/webserver_generic/web_f5_tm_utility_bash_api_request.yml","techniques":["T1190"],"cves":[]},{"id":"85d466b0-d74c-4514-84d3-2bdd3327588b","title":"Oracle WebLogic Exploit CVE-2020-14882","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2020-11-02","modified":"2023-01-02","description":"Detects exploitation attempts on WebLogic servers","references":["https://isc.sans.edu/diary/26734","https://twitter.com/jas502n/status/1321416053050667009?s=20","https://twitter.com/sudo_sudoka/status/1323951871078223874"],"logsource":{"category":"webserver"},"tags":["attack.t1190","attack.initial-access","cve.2020-14882","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-14882/web_cve_2020_14882_weblogic_exploit.yml","techniques":["T1190"],"cves":["CVE-2020-14882"]},{"id":"869b9ca7-9ea2-4a5a-8325-e80e62f75445","title":"Suspicious Child Process Of SQL Server","author":"FPT.EagleEye Team, wagga","status":"test","level":"high","date":"2020-12-11","modified":"2023-05-04","description":"Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.t1505.003","attack.t1190","attack.initial-access","attack.persistence","attack.privilege-escalation"],"path":"rules/windows/process_creation/proc_creation_win_mssql_susp_child_process.yml","techniques":["T1505.003","T1190"],"cves":[]},{"id":"86a7c91f-98c3-4f14-a58d-d989421e1234","title":"Potential SAP NetWeaver Webshell Creation","author":"Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-04-28","modified":null,"description":"Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories,\nwhich may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.\n","references":["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324","https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/","https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.initial-access","attack.t1190","attack.persistence","attack.t1059.003","cve.2025-31324","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_win_sap_netweaver_webshell_creation.yml","techniques":["T1190","T1059.003"],"cves":["CVE-2025-31324"]},{"id":"87c83d8e-5390-44ce-aa4a-d3b37e54d0a0","title":"CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver","author":"Nasreddine Bencherchali (Nextron Systems), Michael Haag (STRT)","status":"test","level":"medium","date":"2023-11-28","modified":null,"description":"Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs.","references":["https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967","https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966","https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/","https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966","https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2023-4966","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit.yml","techniques":["T1190"],"cves":["CVE-2023-4966"]},{"id":"89c42960-f244-4dad-9151-ae9b1a3287a2","title":"Suspicious File Write to Webapps Root Directory","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-10-20","modified":null,"description":"Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers.\nThis may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.\n","references":["https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.persistence","attack.t1505.003","attack.initial-access","attack.t1190"],"path":"rules/windows/file/file_event/file_event_win_susp_file_write_in_webapps_root.yml","techniques":["T1505.003","T1190"],"cves":[]},{"id":"8a670c6d-7189-4b1c-8017-a417ca84a086","title":"Suspicious SQL Error Messages","author":"Bjoern Kimminich","status":"test","level":"high","date":"2017-11-27","modified":"2023-02-12","description":"Detects SQL error messages that indicate probing for an injection attack","references":["http://www.sqlinjection.net/errors"],"logsource":{"product":"sql","category":"application"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/application/sql/app_sqlinjection_errors.yml","techniques":["T1190"],"cves":[]},{"id":"8b244735-5833-4517-a45b-28d8c63924c0","title":"Potential CVE-2023-2283 Exploitation","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2023-06-09","modified":null,"description":"Detects potential exploitation attempt of CVE-2023-2283 an authentication bypass in libSSH. The exploitation method causes an error message stating that keys for curve25519 could not be generated. It is an error message that is a sign of an exploitation attempt. It is not a sign of a successful exploitation.","references":["https://twitter.com/kevin_backhouse/status/1666459308941357056?s=20","https://git.libssh.org/projects/libssh.git/tree/src/curve25519.c#n420","https://nvd.nist.gov/vuln/detail/CVE-2023-2283","https://www.blumira.com/cve-2023-2283/","https://github.com/github/securitylab/tree/1786eaae7f90d87ce633c46bbaa0691d2f9bf449/SecurityExploits/libssh/pubkey-auth-bypass-CVE-2023-2283"],"logsource":{"product":"linux","service":"sshd"},"tags":["attack.initial-access","attack.t1190","cve.2023-2283","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-2283/lnx_sshd_exploit_cve_2023_2283_libssh_authentication_bypass.yml","techniques":["T1190"],"cves":["CVE-2023-2283"]},{"id":"8c7f4a2d-3b9e-4f1c-9a6d-2e8f5c3d9a1b","title":"Suspicious Child Process of SolarWinds WebHelpDesk","author":"Huntress Team, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-02-11","modified":null,"description":"Detects suspicious child processes spawned by SolarWinds WebHelpDesk (WHD) application, which may indicate exploitation activity leveraging RCE vulnerabilities such as CVE-2025-40551, CVE-2025-40536, or CVE-2025-26399\n","references":["https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/","https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399","https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","cve.2025-26399","cve.2025-40536","cve.2025-40551","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-40551/proc_creation_win_exploit_cve_2025_40551.yml","techniques":["T1190"],"cves":["CVE-2025-26399","CVE-2025-40536","CVE-2025-40551"]},{"id":"92d78c63-5a5c-4c40-9b60-463810ffb082","title":"OWASSRF Exploitation Attempt Using Public POC - Webserver","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"critical","date":"2022-12-22","modified":"2023-01-02","description":"Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint","references":["https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/","https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/","https://twitter.com/purp1ew0lf/status/1602989967776808961?s=12&t=OkZJl_ViICeiftVEsohRyw"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-41082/web_cve_2022_36804_exchange_owassrf_poc_exploitation.yml","techniques":["T1190"],"cves":[]},{"id":"94e12f41-6cb3-45c5-97b1-c783a7bf2e72","title":"Potential SAP NetViewer Webshell Command Execution","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-05-14","modified":null,"description":"Detects potential command execution via webshell in SAP NetViewer through JSP files with cmd parameter.\nThis rule is created to detect exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell.\n","references":["https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures"],"logsource":{"category":"webserver"},"tags":["attack.persistence","attack.t1505.003","attack.initial-access","attack.t1190","detection.emerging-threats","cve.2025-31324"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell.yml","techniques":["T1505.003","T1190"],"cves":["CVE-2025-31324"]},{"id":"97661d9d-2beb-4630-b423-68985291a8af","title":"Potential RCE Exploitation Attempt In NodeJS","author":"Moti Harmats","status":"test","level":"high","date":"2023-02-11","modified":null,"description":"Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest an RCE vulnerability.","references":["https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs"],"logsource":{"product":"nodejs","category":"application"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/application/nodejs/nodejs_rce_exploitation_attempt.yml","techniques":["T1190"],"cves":[]},{"id":"9be472ed-893c-4ec0-94da-312d2765f654","title":"Log4j RCE CVE-2021-44228 in Fields","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-12-10","modified":"2023-01-02","description":"Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)","references":["https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/","https://news.ycombinator.com/item?id=29504755","https://github.com/tangxiaofeng7/apache-log4j-poc","https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b","https://github.com/YfryTchsGD/Log4jAttackSurface","https://twitter.com/shutingrz/status/1469255861394866177?s=21"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-44228","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j_fields.yml","techniques":["T1190"],"cves":["CVE-2021-44228"]},{"id":"a133193c-2daa-4a29-8022-018695fcf0ae","title":"Rejetto HTTP File Server RCE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-07-19","modified":"2023-01-02","description":"Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287","references":["https://vk9-sec.com/hfs-code-execution-cve-2014-6287/","https://www.exploit-db.com/exploits/39161","https://github.com/Twigonometry/Cybersecurity-Notes/blob/c875b0f52df7d2c7a870e75e1f0c2679d417931d/Writeups/Hack%20the%20Box/Boxes/Optimum/10%20-%20Website.md"],"logsource":{"category":"webserver"},"tags":["attack.persistence","attack.initial-access","attack.t1190","attack.t1505.003","cve.2014-6287","detection.emerging-threats"],"path":"rules-emerging-threats/2014/Exploits/CVE-2014-6287/web_cve_2014_6287_hfs_rce.yml","techniques":["T1190","T1505.003"],"cves":["CVE-2014-6287"]},{"id":"a2a9d722-0acb-4096-bccc-daaf91a5037b","title":"Exchange Exploitation CVE-2021-28480","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2021-05-14","modified":"2023-01-02","description":"Detects successful exploitation of Exchange vulnerability as reported in CVE-2021-28480","references":["https://twitter.com/GossiTheDog/status/1392965209132871683?s=20"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-28480","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-28480/web_cve_2021_28480_exchange_exploit.yml","techniques":["T1190"],"cves":["CVE-2021-28480"]},{"id":"a2bcca38-9f3a-4d5e-b603-0c587e8569d7","title":"Potential Information Disclosure CVE-2023-43261 Exploitation - Web","author":"Nasreddine Bencherchali (Nextron Systems), Thurein Oo","status":"test","level":"high","date":"2023-10-20","modified":"2023-10-30","description":"Detects exploitation attempts of CVE-2023-43261 and information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 that allows attackers to access sensitive router components in access logs.\n","references":["https://thehackernews.com/2023/10/experts-warn-of-severe-flaws-affecting.html","https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf","https://github.com/win3zz/CVE-2023-43261","https://vulncheck.com/blog/real-world-cve-2023-43261"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2023-43621","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-43261/web_exploit_cve_2023_43261_milesight_information_disclosure.yml","techniques":["T1190"],"cves":["CVE-2023-43621"]},{"id":"a2e97350-4285-43f2-a63f-d0daff291738","title":"Fortinet CVE-2018-13379 Exploitation","author":"Bhabesh Raj","status":"test","level":"critical","date":"2020-12-08","modified":"2023-01-02","description":"Detects CVE-2018-13379 exploitation attempt against Fortinet SSL VPNs","references":["https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2018-13379","detection.emerging-threats"],"path":"rules-emerging-threats/2018/Exploits/CVE-2018-13379/web_cve_2018_13379_fortinet_preauth_read_exploit.yml","techniques":["T1190"],"cves":["CVE-2018-13379"]},{"id":"a4a899e8-fd7a-49dd-b5a8-7044def72d61","title":"CVE-2010-5278 Exploitation Attempt","author":"Subhash Popuri (@pbssubhash)","status":"test","level":"critical","date":"2021-08-25","modified":"2023-01-02","description":"MODx manager - Local File Inclusion:Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier,\nwhen magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter.\n","references":["https://github.com/projectdiscovery/nuclei-templates"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2010-5278","detection.emerging-threats"],"path":"rules-emerging-threats/2010/Exploits/CVE-2010-5278/web_cve_2010_5278_exploitation_attempt.yml","techniques":["T1190"],"cves":["CVE-2010-5278"]},{"id":"a4e068b5-e27c-4f21-85b3-e69e5a4f7ce1","title":"CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-11-28","modified":null,"description":"Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs by looking for a very long host header string.","references":["https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967","https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966","https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/","https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966","https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2023-4966","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml","techniques":["T1190"],"cves":["CVE-2023-4966"]},{"id":"a7c4e2f9-1b38-4d5c-9e72-3f4a5b6c7d8e","title":"WordPress Wp2shell Exploitation Tool User-Agent","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-07-19","modified":null,"description":"Detects the hardcoded \"wp2shell\" User-Agent string used by the wp2shell\nPoC tool during all phases of CVE-2026-63030 and CVE-2026-60137 exploitation.\n","references":["https://github.com/Icex0/wp2shell-poc","https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/","https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2026-63030","cve.2026-60137","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_wp2shell_tool_useragent.yml","techniques":["T1190"],"cves":["CVE-2026-63030","CVE-2026-60137"]},{"id":"a7cd7306-df8b-4398-b711-6f3e4935cf16","title":"Potential CVE-2022-26809 Exploitation Attempt","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-04-13","modified":"2023-02-03","description":"Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809","https://www.bleepingcomputer.com/startups/RpcSs.exe-14544.html","https://twitter.com/cyb3rops/status/1514217991034097664","https://www.securonix.com/blog/cve-2022-26809-remote-procedure-call-runtime-remote-code-execution-vulnerability-and-coverage/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","attack.execution","attack.t1569.002","cve.2022-26809","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-26809/proc_creation_win_exploit_cve_2022_26809_rpcss_child_process_anomaly.yml","techniques":["T1190","T1569.002"],"cves":["CVE-2022-26809"]},{"id":"a902d249-9b9c-4dc4-8fd0-fbe528ef965c","title":"CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"medium","date":"2023-11-14","modified":null,"description":"Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.\n","references":["https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html","https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment","https://github.com/ForceFledgling/CVE-2023-22518"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2023-22518","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-22518/web_exploit_cve_2023_22518_confluence_auth_bypass.yml","techniques":["T1190"],"cves":["CVE-2023-22518"]},{"id":"ab6b1a39-a9ee-4ab4-b075-e83acf6e346b","title":"OMIGOD HTTP No Authentication RCE - CVE-2021-38647","author":"Nate Guagenti (neu5ron)","status":"stable","level":"high","date":"2021-09-20","modified":"2025-11-03","description":"Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request.\nVerify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP).\nWithin the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.\n","references":["https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure","https://twitter.com/neu5ron/status/1438987292971053057?s=20"],"logsource":{"product":"zeek","service":"http"},"tags":["attack.privilege-escalation","attack.initial-access","attack.execution","attack.lateral-movement","attack.t1068","attack.t1190","attack.t1203","attack.t1021.006","attack.t1210","detection.emerging-threats","cve.2021-38647"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-38647/zeek_http_exploit_cve_2021_38647_omigod_no_auth_rce.yml","techniques":["T1068","T1190","T1203","T1021.006","T1210"],"cves":["CVE-2021-38647"]},{"id":"aba47adc-4847-4970-95c1-61dce62a8b29","title":"Cisco ASA FTD Exploit CVE-2020-3452","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-01-07","modified":"2023-01-02","description":"Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452 with a status code of 200 (sccessful exploitation)","references":["https://twitter.com/aboul3la/status/1286012324722155525","https://github.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter"],"logsource":{"category":"webserver"},"tags":["attack.t1190","attack.initial-access","cve.2020-3452","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-3452/web_cve_2020_3452_cisco_asa_ftd.yml","techniques":["T1190"],"cves":["CVE-2020-3452"]},{"id":"ac5a6409-8c89-44c2-8d64-668c29a2d756","title":"Citrix Netscaler Attack CVE-2019-19781","author":"Arnim Rupp, Florian Roth","status":"test","level":"critical","date":"2020-01-02","modified":"2023-01-02","description":"Detects CVE-2019-19781 exploitation attempt against Citrix Netscaler, Application Delivery Controller and Citrix Gateway Attack","references":["https://support.citrix.com/article/CTX267679","https://support.citrix.com/article/CTX267027","https://isc.sans.edu/diary/25686","https://twitter.com/mpgn_x64/status/1216787131210829826","https://github.com/x1sec/CVE-2019-19781/blob/25f7ab97275b2d41800bb3414dac8ca3a78af7e5/CVE-2019-19781-DFIR.md"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2019-19781","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Exploits/CVE-2019-19781/web_cve_2019_19781_citrix_exploit.yml","techniques":["T1190"],"cves":["CVE-2019-19781"]},{"id":"ae48ab93-45f7-4051-9dfe-5d30a3f78e33","title":"Spring Framework Exceptions","author":"Thomas Patzke","status":"stable","level":"medium","date":"2017-08-06","modified":"2020-09-01","description":"Detects suspicious Spring framework exceptions that could indicate exploitation attempts","references":["https://docs.spring.io/spring-security/site/docs/current/api/overview-tree.html"],"logsource":{"product":"spring","category":"application"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/application/spring/spring_application_exceptions.yml","techniques":["T1190"],"cves":[]},{"id":"aee7681f-b53d-4594-a9de-ac51e6ad3362","title":"CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-11-28","modified":null,"description":"Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs by looking for a very long host header string.","references":["https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967","https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966","https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/","https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966","https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966"],"logsource":{"category":"proxy"},"tags":["attack.initial-access","attack.t1190","cve.2023-4966","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-4966/proxy_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit.yml","techniques":["T1190"],"cves":["CVE-2023-4966"]},{"id":"af1ac430-df6b-4b38-b976-0b52f07a0252","title":"OpenCanary - HTTP POST Login Attempt","author":"Security Onion Solutions","status":"test","level":"high","date":"2024-03-08","modified":null,"description":"Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.\n","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/application/opencanary/opencanary_http_post_login_attempt.yml","techniques":["T1190"],"cves":[]},{"id":"af6c3078-84cd-4c68-8842-08b76bd81b13","title":"OpenCanary - HTTP GET Request","author":"Security Onion Solutions","status":"test","level":"high","date":"2024-03-08","modified":null,"description":"Detects instances where an HTTP service on an OpenCanary node has received a GET request.","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/application/opencanary/opencanary_http_get.yml","techniques":["T1190"],"cves":[]},{"id":"aff715fa-4dd5-497a-8db3-910bea555566","title":"DNS Query to External Service Interaction Domains","author":"Florian Roth (Nextron Systems), Matt Kelly (list of domains)","status":"test","level":"high","date":"2022-06-07","modified":"2026-07-23","description":"Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains.\nThese services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn) are used by security\nresearchers and attackers alike to confirm blind vulnerabilities such as SSRF, XXE, blind RCE, and\nLog4Shell-style injections, where the exploit payload triggers an external DNS lookup to a controlled domain.\n\nA detection indicates that a host on your network resolved one of these domains, which may mean:\n    (1) an attacker is actively probing or exploiting a vulnerable service and using the callback to\n    confirm code execution or data exfiltration,\n    (2) a security scanner (e.g. Nuclei, Gobies) is running against internal targets.\n\nInvestigate the source host, the full DNS query string (the unique subdomain prefix encodes the callback session),\nand any concurrent outbound connections or process activity to determine intent.\n","references":["https://twitter.com/breakersall/status/1533493587828260866","https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-critical-unauthenticated-rce-windows-server-update-services-cve-2025-59287","https://github.com/SigmaHQ/sigma/pull/5724#issuecomment-3466382234","https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve"],"logsource":{"category":"dns"},"tags":["attack.initial-access","attack.t1190","attack.reconnaissance","attack.t1595.002"],"path":"rules/network/dns/net_dns_external_service_interaction_domains.yml","techniques":["T1190","T1595.002"],"cves":[]},{"id":"b014ea07-8ea0-4859-b517-50a4e5b7ecec","title":"VMware vCenter Server File Upload CVE-2021-22005","author":"Sittikorn S","status":"test","level":"high","date":"2021-09-24","modified":"2023-01-02","description":"Detects exploitation attempts using file upload vulnerability CVE-2021-22005 in the VMWare vCenter Server.","references":["https://kb.vmware.com/s/article/85717","https://www.tenable.com/blog/cve-2021-22005-critical-file-upload-vulnerability-in-vmware-vcenter-server"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-22005","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-22005/web_cve_2021_22005_vmware_file_upload.yml","techniques":["T1190"],"cves":["CVE-2021-22005"]},{"id":"b19146a3-25d4-41b4-928b-1e2a92641b1b","title":"Remote Access Tool - ScreenConnect Server Web Shell Execution","author":"Jason Rathbun (Blackpoint Cyber)","status":"test","level":"high","date":"2024-02-26","modified":null,"description":"Detects potential web shell execution from the ScreenConnect server process.","references":["https://blackpointcyber.com/resources/blog/breaking-through-the-screen/","https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_webshell.yml","techniques":["T1190"],"cves":[]},{"id":"b5281f31-f9cc-4d0d-95d0-45b91c45b487","title":"DNS RCE CVE-2020-1350","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2020-07-15","modified":"2022-07-12","description":"Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process","references":["https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/","https://web.archive.org/web/20230329172447/https://blog.menasec.net/2019/02/threat-hunting-24-microsoft-windows-dns.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","attack.execution","attack.t1569.002","cve.2020-1350","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-1350/proc_creation_win_exploit_cve_2020_1350.yml","techniques":["T1190","T1569.002"],"cves":["CVE-2020-1350"]},{"id":"b59c98c6-95e8-4d65-93ee-f594dfb96b17","title":"F5 BIG-IP iControl Rest API Command Execution - Proxy","author":"Nasreddine Bencherchali (Nextron Systems), Thurein Oo","status":"test","level":"medium","date":"2023-11-08","modified":null,"description":"Detects POST requests to the F5 BIG-IP iControl Rest API \"bash\" endpoint, which allows the execution of commands on the BIG-IP","references":["https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash","https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029","https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516"],"logsource":{"category":"proxy"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/web/proxy_generic/proxy_f5_tm_utility_bash_api_request.yml","techniques":["T1190"],"cves":[]},{"id":"b8d5f301-2c49-4e6d-af83-4a5b6c7d8e9f","title":"WordPress Wp2shell REST Batch Endpoint Exploitation","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-07-19","modified":null,"description":"Detects exploitation attempts against the WordPress REST batch endpoint (CVE-2026-63030,\nCVE-2026-60137) using the wp2shell PoC tool. The tool sends POST requests to the batch endpoint\nvia the ?rest_route=/batch/v1 query parameter, covering all attack phases from initial probe\nthrough SQL injection and pre-auth admin creation. A 207 response confirms the endpoint is\nactive on the target.\n","references":["https://github.com/Icex0/wp2shell-poc","https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/","https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","detection.emerging-threats","cve.2026-63030","cve.2026-60137"],"path":"rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_batch_rest_route_abuse.yml","techniques":["T1190"],"cves":["CVE-2026-63030","CVE-2026-60137"]},{"id":"b9888738-29ed-4c54-96a4-f38c57b84bb3","title":"Exploitation of CVE-2021-26814 in Wazuh","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-05-22","modified":"2023-01-02","description":"Detects the exploitation of the Wazuh RCE vulnerability described in CVE-2021-26814","references":["https://github.com/WickdDavid/CVE-2021-26814/blob/6a17355a10ec4db771d0f112cbe031e418d829d5/PoC.py"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-21978","cve.2021-26814","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-26814/web_cve_2021_26814_wzuh_rce.yml","techniques":["T1190"],"cves":["CVE-2021-21978","CVE-2021-26814"]},{"id":"ba479447-721f-42a9-9af2-6dcd517bbdb3","title":"Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"critical","date":"2025-07-21","modified":"2025-07-24","description":"Detects the creation of file such as spinstall0.aspx which may indicate successful exploitation of CVE-2025-53770.\nCVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.\n","references":["https://research.eye.security/sharepoint-under-siege/","https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/","https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.initial-access","attack.t1190","cve.2025-53770","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-53770/file_event_win_exploit_cve_2025_53770.yml","techniques":["T1190"],"cves":["CVE-2025-53770"]},{"id":"bb0e9cec-d4da-46f5-997f-22efc59f3dca","title":"Potential JNDI Injection Exploitation In JVM Based Application","author":"Moti Harmats","status":"test","level":"high","date":"2023-02-11","modified":null,"description":"Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.","references":["https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs","https://secariolabs.com/research/analysing-and-reproducing-poc-for-log4j-2-15-0"],"logsource":{"product":"jvm","category":"application"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/application/jvm/java_jndi_injection_exploitation_attempt.yml","techniques":["T1190"],"cves":[]},{"id":"c3b2a774-3152-4989-83c1-7afc48fd1599","title":"Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-06-01","modified":"2024-08-13","description":"Detects file indicators of potential exploitation of MOVEit CVE-2023-34362.","references":["https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/","https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023","https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/","https://www.reddit.com/r/sysadmin/comments/13wxuej/comment/jmhdg55/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.initial-access","attack.t1190","cve.2023-34362","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/file_event_win_exploit_cve_2023_34362_moveit_transfer.yml","techniques":["T1190"],"cves":["CVE-2023-34362"]},{"id":"c42a3073-30fb-48ae-8c99-c23ada84b103","title":"Hack Tool User Agent","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-07-08","modified":"2022-07-07","description":"Detects suspicious user agent strings user by hack tools in proxy logs","references":["https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb","http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules"],"logsource":{"category":"proxy"},"tags":["attack.initial-access","attack.t1190","attack.credential-access","attack.t1110"],"path":"rules/web/proxy_generic/proxy_ua_hacktool.yml","techniques":["T1190","T1110"],"cves":[]},{"id":"c4e06896-e27c-4583-95ac-91ce2279345d","title":"Potential XXE Exploitation Attempt In JVM Based Application","author":"Moti Harmats","status":"test","level":"high","date":"2023-02-11","modified":null,"description":"Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.","references":["https://rules.sonarsource.com/java/RSPEC-2755","https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing","https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs"],"logsource":{"product":"jvm","category":"application"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/application/jvm/java_xxe_exploitation_attempt.yml","techniques":["T1190"],"cves":[]},{"id":"c70834fa-fb9d-4aa0-9e7d-45ceed36f3f7","title":"Linux Suspicious Child Process from Node.js - React2Shell","author":"Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali","status":"experimental","level":"high","date":"2025-12-05","modified":null,"description":"Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell).\nThis rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands.\nWhen execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>).\nFor other methods, the Image field will show the spawned process directly.\n","references":["https://github.com/msanft/CVE-2025-55182","https://nodejs.org/api/child_process.html#class-childprocess","https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870","https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059","attack.initial-access","attack.t1190","detection.emerging-threats","cve.2025-55182"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_lnx_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml","techniques":["T1059","T1190"],"cves":["CVE-2025-55182"]},{"id":"c8a5f584-cdc8-42cc-8cce-0398e4265de3","title":"Apache Spark Shell Command Injection - ProcessCreation","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-07-20","modified":null,"description":"Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective","references":["https://github.com/W01fh4cker/cve-2022-33891/blob/fd973b56e78bca8822caa3a2e3cf1b5aff5d0950/cve_2022_33891_poc.py","https://sumsec.me/2022/CVE-2022-33891%20Apache%20Spark%20shell%20command%20injection.html","https://github.com/apache/spark/pull/36315/files"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","cve.2022-33891","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-33891/proc_creation_lnx_exploit_cve_2022_33891_spark_shell_command_injection.yml","techniques":["T1190"],"cves":["CVE-2022-33891"]},{"id":"c8e35e96-19ce-4f16-aeb6-fd5588dc5365","title":"Suspicious Named Error","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2018-02-20","modified":"2022-10-05","description":"Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts","references":["https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/named_rules.xml"],"logsource":{"product":"linux","service":"syslog"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/linux/builtin/syslog/lnx_syslog_susp_named.yml","techniques":["T1190"],"cves":[]},{"id":"d033cb8a-8669-4a8e-a974-48d4185a8503","title":"Potential CVE-2022-21587 Exploitation Attempt","author":"Isa Almannaei","status":"test","level":"high","date":"2023-02-13","modified":null,"description":"Detects potential exploitation attempts of CVE-2022-21587 an arbitrary file upload vulnerability impacting Oracle E-Business Suite (EBS). CVE-2022-21587 can lead to unauthenticated remote code execution.","references":["https://www.rapid7.com/blog/post/2023/02/07/etr-cve-2022-21587-rapid7-observed-exploitation-of-oracle-e-business-suite-vulnerability/","https://attackerkb.com/topics/Bkij5kK1qK/cve-2022-21587/rapid7-analysis","https://github.com/hieuminhnv/CVE-2022-21587-POC","https://blog.viettelcybersecurity.com/cve-2022-21587-oracle-e-business-suite-unauth-rce/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2022-21587","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-21587/web_cve_2022_21587_oracle_ebs.yml","techniques":["T1190"],"cves":["CVE-2022-21587"]},{"id":"d6266bf5-935e-4661-b477-78772735a7cb","title":"CVE-2020-0688 Exploitation via Eventlog","author":"Florian Roth (Nextron Systems), wagga","status":"test","level":"high","date":"2020-02-29","modified":"2022-12-25","description":"Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688","references":["https://www.trustedsec.com/blog/detecting-cve-20200688-remote-code-execution-vulnerability-on-microsoft-exchange-server/","https://cyberpolygon.com/materials/okhota-na-ataki-ms-exchange-chast-2-cve-2020-0688-cve-2020-16875-cve-2021-24085/"],"logsource":{"product":"windows","service":"application"},"tags":["attack.initial-access","attack.t1190","cve.2020-0688","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-0688/win_vul_cve_2020_0688.yml","techniques":["T1190"],"cves":["CVE-2020-0688"]},{"id":"d65f37da-a26a-48f8-8159-3dde96680ad2","title":"Process Execution Error In JVM Based Application","author":"Moti Harmats","status":"test","level":"high","date":"2023-02-11","modified":null,"description":"Detects process execution related exceptions in JVM based apps, often relates to RCE","references":["https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs"],"logsource":{"product":"jvm","category":"application"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/application/jvm/java_rce_exploitation_attempt.yml","techniques":["T1190"],"cves":[]},{"id":"d84c0ded-edd7-4123-80ed-348bb3ccc4d5","title":"Suspicious SQL Query","author":"@juju4","status":"test","level":"medium","date":"2022-12-27","modified":null,"description":"Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields","references":["https://github.com/sqlmapproject/sqlmap"],"logsource":{"category":"database"},"tags":["attack.exfiltration","attack.initial-access","attack.privilege-escalation","attack.persistence","attack.t1190","attack.t1505.001"],"path":"rules/category/database/db_anomalous_query.yml","techniques":["T1190","T1505.001"],"cves":[]},{"id":"dd218fb6-4d02-42dc-85f0-a0a376072efd","title":"Zimbra Collaboration Suite Email Server Unauthenticated RCE","author":"@gott_cyber","status":"test","level":"medium","date":"2022-08-17","modified":"2023-01-02","description":"Detects an attempt to leverage the vulnerable servlet \"mboximport\" for an unauthenticated remote command injection","references":["https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/","https://www.yang99.top/index.php/archives/82/","https://github.com/vnhacker1337/CVE-2022-27925-PoC"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2022-27925","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-27925/web_cve_2022_27925_exploit.yml","techniques":["T1190"],"cves":["CVE-2022-27925"]},{"id":"e032f5bc-4563-4096-ae3b-064bab588685","title":"Potential Local File Read Vulnerability In JVM Based Application","author":"Moti Harmats","status":"test","level":"high","date":"2023-02-11","modified":null,"description":"Detects potential local file read vulnerability in JVM based apps.\nIf the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.\n","references":["https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs"],"logsource":{"product":"jvm","category":"application"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/application/jvm/java_local_file_read.yml","techniques":["T1190"],"cves":[]},{"id":"e5f66e87-7d6b-404f-92fe-7aa67814b5cd","title":"Exploitation Activity of CVE-2025-59287 - WSUS Deserialization","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-10-31","modified":null,"description":"Detects cast exceptions in Windows Server Update Services (WSUS) application logs that highly indicate exploitation attempts of CVE-2025-59287, a deserialization vulnerability in WSUS.\n","references":["https://unit42.paloaltonetworks.com/cve-2025-59287/","https://hawktrace.com/blog/CVE-2025-59287-UNAUTH","https://github.com/0xBruno/WSUSploit.NET/tree/e239bce9d6b5f46a346e1e4c4d5e0a2a20d5c639","https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability"],"logsource":{"product":"windows","service":"application"},"tags":["attack.execution","attack.initial-access","attack.t1190","attack.t1203","cve.2025-59287","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-59287/win_wsus_exploit_cve_2025_59287.yml","techniques":["T1190","T1203"],"cves":["CVE-2025-59287"]},{"id":"e76b413a-83d0-4b94-8e4c-85db4a5b8bdc","title":"Suspicious OpenSSH Daemon Error","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2017-06-30","modified":"2021-11-27","description":"Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts","references":["https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c","https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/sshd_rules.xml"],"logsource":{"product":"linux","service":"sshd"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/linux/builtin/sshd/lnx_sshd_susp_ssh.yml","techniques":["T1190"],"cves":[]},{"id":"e9928831-ba14-42ea-a4bc-33d352b9929a","title":"CVE-2023-46747 Exploitation Activity - Webserver","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-11-08","modified":null,"description":"Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.","references":["https://github.com/AliBrTab/CVE-2023-46747-POC/tree/main","https://github.com/0xorOne/nuclei-templates/blob/2fef4270ec6e5573d0a1732cb18bcfc4b1580a88/http/cves/2023/CVE-2023-46747.yaml","https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg","https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2023-46747","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-46747/web_cve_2023_46747_f5_remote_code_execution.yml","techniques":["T1190"],"cves":["CVE-2023-46747"]},{"id":"e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c","title":"Apache Threading Error","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2019-01-22","modified":"2021-11-27","description":"Detects an issue in apache logs that reports threading related errors","references":["https://github.com/hannob/apache-uaf/blob/da40f2be3684c8095ec6066fa68eb5c07a086233/README.md"],"logsource":{"service":"apache"},"tags":["attack.initial-access","attack.lateral-movement","attack.t1190","attack.t1210"],"path":"rules/web/product/apache/web_apache_threading_error.yml","techniques":["T1190","T1210"],"cves":[]},{"id":"e9bc39ae-978a-4e49-91ab-5bd481fc668b","title":"Confluence Exploitation CVE-2019-3398","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2020-05-26","modified":"2023-01-02","description":"Detects the exploitation of the Confluence vulnerability described in CVE-2019-3398","references":["https://devcentral.f5.com/s/articles/confluence-arbitrary-file-write-via-path-traversal-cve-2019-3398-34181"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2019-3398","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Exploits/CVE-2019-3398/web_cve_2019_3398_confluence.yml","techniques":["T1190"],"cves":["CVE-2019-3398"]},{"id":"e9edd087-89d8-48c9-b0b4-5b9bb10896b8","title":"Potential SpEL Injection In Spring Framework","author":"Moti Harmats","status":"test","level":"high","date":"2023-02-11","modified":null,"description":"Detects potential SpEL Injection exploitation, which may lead to RCE.","references":["https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection","https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs"],"logsource":{"product":"spring","category":"application"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/application/spring/spring_spel_injection.yml","techniques":["T1190"],"cves":[]},{"id":"efdb2003-a922-48aa-8f37-8b80021a9706","title":"CVE-2022-31659 VMware Workspace ONE Access RCE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-12","modified":"2023-01-02","description":"Detects possible exploitation of VMware Workspace ONE Access Admin Remote Code Execution vulnerability as described in CVE-2022-31659","references":["https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2022-31659","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-31659/web_cve_2022_31659_vmware_rce.yml","techniques":["T1190"],"cves":["CVE-2022-31659"]},{"id":"effee1f6-a932-4297-a81f-acb44064fa3a","title":"ProxyLogon Reset Virtual Directories Based On IIS Log","author":"frack113","status":"test","level":"critical","date":"2021-08-10","modified":"2023-05-08","description":"When exploiting this vulnerability with CVE-2021-26858, an SSRF attack is used to manipulate virtual directories","references":["https://bi-zone.medium.com/hunting-down-ms-exchange-attacks-part-1-proxylogon-cve-2021-26855-26858-27065-26857-6e885c5f197c"],"logsource":{"category":"webserver"},"tags":["cve.2021-26858","detection.emerging-threats","attack.initial-access","attack.t1190"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-26858/web_cve_2021_26858_iis_rce.yml","techniques":["T1190"],"cves":["CVE-2021-26858"]},{"id":"f007b877-02e3-45b7-8501-1b78c2864029","title":"CVE-2024-50623 Exploitation Attempt - Cleo","author":"Tanner Filip, Austin Worline, Chad Hudson, Matt Anderson","status":"experimental","level":"high","date":"2024-12-09","modified":null,"description":"Detects exploitation attempt of Cleo's CVE-2024-50623 by looking for a \"cmd.exe\" process spawning from the Celo software suite with suspicious Powershell commandline.\n","references":["https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.execution","attack.t1190","cve.2024-50623","detection.emerging-threats"],"path":"rules-emerging-threats/2024/Exploits/CVE-2024-50623/proc_creation_win_exploit_cve_2024_50623_cleo.yml","techniques":["T1190"],"cves":["CVE-2024-50623"]},{"id":"f0500377-bc70-425d-ac8c-e956cd906871","title":"Arcadyan Router Exploitations","author":"Bhabesh Raj","status":"test","level":"critical","date":"2021-08-24","modified":"2023-01-02","description":"Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.","references":["https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2","https://www.tenable.com/security/research/tra-2021-13","https://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-20090","cve.2021-20091","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-20090/web_cve_2021_20090_2021_20091_arcadyan_router_exploit.yml","techniques":["T1190"],"cves":["CVE-2021-20090","CVE-2021-20091"]},{"id":"f195b2ff-e542-41bf-8d91-864fb81e5c20","title":"CVE-2023-46747 Exploitation Activity - Proxy","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-11-08","modified":null,"description":"Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.","references":["https://github.com/AliBrTab/CVE-2023-46747-POC/tree/main","https://github.com/0xorOne/nuclei-templates/blob/2fef4270ec6e5573d0a1732cb18bcfc4b1580a88/http/cves/2023/CVE-2023-46747.yaml","https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg","https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/"],"logsource":{"category":"proxy"},"tags":["attack.initial-access","attack.t1190","cve.2023-46747","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-46747/proxy_cve_2023_46747_f5_remote_code_execution.yml","techniques":["T1190"],"cves":["CVE-2023-46747"]},{"id":"f425637f-891c-4191-a6c4-3bb1b70513b4","title":"Fortinet CVE-2021-22123 Exploitation","author":"Bhabesh Raj, Florian Roth","status":"test","level":"critical","date":"2021-08-19","modified":"2023-01-02","description":"Detects CVE-2021-22123 exploitation attempt against Fortinet WAFs","references":["https://www.rapid7.com/blog/post/2021/08/17/fortinet-fortiweb-os-command-injection"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2021-22123","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-22123/web_cve_2021_22123_fortinet_exploit.yml","techniques":["T1190"],"cves":["CVE-2021-22123"]},{"id":"f48f5368-355c-4a1b-8bf5-11c13d589eaa","title":"Potential Information Disclosure CVE-2023-43261 Exploitation - Proxy","author":"Nasreddine Bencherchali (Nextron Systems), Thurein Oo","status":"test","level":"high","date":"2023-10-20","modified":"2023-10-30","description":"Detects exploitation attempts of CVE-2023-43261 and information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 that allows attackers to access sensitive router components in proxy logs.\n","references":["https://thehackernews.com/2023/10/experts-warn-of-severe-flaws-affecting.html","https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf","https://github.com/win3zz/CVE-2023-43261","https://vulncheck.com/blog/real-world-cve-2023-43261"],"logsource":{"category":"proxy"},"tags":["attack.initial-access","attack.t1190","cve.2023-43621","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-43261/proxy_exploit_cve_2023_43261_milesight_information_disclosure.yml","techniques":["T1190"],"cves":["CVE-2023-43621"]},{"id":"f88e112a-21aa-44bd-9b01-6ee2a2bbbed1","title":"Failed Logon From Public IP","author":"NVISO","status":"test","level":"medium","date":"2020-05-06","modified":"2024-03-11","description":"Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078","attack.t1190","attack.t1133"],"path":"rules/windows/builtin/security/account_management/win_security_susp_failed_logon_source.yml","techniques":["T1078","T1190","T1133"],"cves":[]},{"id":"f8987c03-4290-4c96-870f-55e75ee377f4","title":"CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"high","date":"2023-11-14","modified":null,"description":"Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.\n","references":["https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html","https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment","https://github.com/ForceFledgling/CVE-2023-22518"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059","attack.initial-access","attack.t1190","cve.2023-22518","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_lnx_exploit_cve_2023_22518_confluence_java_child_proc.yml","techniques":["T1059","T1190"],"cves":["CVE-2023-22518"]},{"id":"fcbb4a77-f368-4945-b046-4499a1da69d1","title":"CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit","author":"Sittikorn S, Nuttakorn Tungpoonsup","status":"test","level":"critical","date":"2021-09-10","modified":"2023-01-02","description":"Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).","references":["https://therecord.media/cisa-warns-of-zoho-server-zero-day-exploited-in-the-wild/","https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html","https://us-cert.cisa.gov/ncas/alerts/aa21-259a"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","attack.persistence","attack.t1505.003","cve.2021-40539","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_manageengine_adselfservice_exploit.yml","techniques":["T1190","T1505.003"],"cves":["CVE-2021-40539"]},{"id":"fce2c2e2-0fb5-41ab-a14c-5391e1fd70a5","title":"CVE-2020-0688 Exchange Exploitation via Web Log","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2020-02-29","modified":"2023-01-02","description":"Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688","references":["https://www.trustedsec.com/blog/detecting-cve-20200688-remote-code-execution-vulnerability-on-microsoft-exchange-server/"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2020-0688","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-0688/web_cve_2020_0688_msexchange.yml","techniques":["T1190"],"cves":["CVE-2020-0688"]},{"id":"fcf1101d-07c9-49b2-ad81-7e421ff96d80","title":"CVE-2022-31656 VMware Workspace ONE Access Auth Bypass","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-12","modified":"2023-01-02","description":"Detects the exploitation of VMware Workspace ONE Access Authentication Bypass vulnerability as described in CVE-2022-31656\nVMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users.\nA malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.\n","references":["https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1190","cve.2022-31656","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-31656/web_cve_2022_31656_auth_bypass.yml","techniques":["T1190"],"cves":["CVE-2022-31656"]},{"id":"fd435618-981e-4a7c-81f8-f78ce480d616","title":"Django Framework Exceptions","author":"Thomas Patzke","status":"stable","level":"medium","date":"2017-08-05","modified":"2020-09-01","description":"Detects suspicious Django web application framework exceptions that could indicate exploitation attempts","references":["https://docs.djangoproject.com/en/1.11/ref/exceptions/","https://docs.djangoproject.com/en/1.11/topics/logging/#django-security"],"logsource":{"product":"django","category":"application"},"tags":["attack.initial-access","attack.t1190"],"path":"rules/application/django/appframework_django_exceptions.yml","techniques":["T1190"],"cves":[]},{"id":"fdd7e904-7304-4616-a46a-e32f917c4be4","title":"OWASSRF Exploitation Attempt Using Public POC - Proxy","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"critical","date":"2022-12-22","modified":null,"description":"Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint","references":["https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/","https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/","https://twitter.com/purp1ew0lf/status/1602989967776808961?s=12&t=OkZJl_ViICeiftVEsohRyw"],"logsource":{"category":"proxy"},"tags":["attack.initial-access","attack.t1190","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-41082/proxy_cve_2022_36804_exchange_owassrf_poc_exploitation.yml","techniques":["T1190"],"cves":[]},{"id":"ff0225a0-1d9a-4bae-ab26-6038b18bb6d4","title":"Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791)","author":"X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-10-20","modified":null,"description":"Detects the use of argument injection in the Commvault qlogin command - potential exploitation for CVE-2025-57791.\nAn attacker can inject the `-localadmin` parameter via the password field to bypass authentication and gain a privileged token.\n","references":["https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","detection.emerging-threats","cve.2025-57791"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-57791/proc_creation_win_exploit_cve_2025_57791.yml","techniques":["T1190"],"cves":["CVE-2025-57791"]},{"id":"ff349b81-617f-4af4-924f-dbe8ea9bab41","title":"CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy","author":"Nasreddine Bencherchali (Nextron Systems), Michael Haag (STRT)","status":"test","level":"medium","date":"2023-11-28","modified":null,"description":"Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs.","references":["https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967","https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966","https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/","https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966","https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966"],"logsource":{"category":"proxy"},"tags":["attack.initial-access","attack.t1190","cve.2023-4966","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-4966/proxy_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml","techniques":["T1190"],"cves":["CVE-2023-4966"]}],"kev_cves":[{"cveID":"CVE-2025-49704","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-49706","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-53770","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-25257","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-5777","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2016-10033","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-0769","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-35939","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-38950","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-4428","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-4427","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-42999","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-34028","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-38475","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-42599","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-22457","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2017-12637","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-48248","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-1316","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-13161","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-13160","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-13159","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-43939","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-20953","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-0108","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-57727","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-23006","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-48365","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-0282","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-55550","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-4879","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-34102","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-4358","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-4577","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-40655","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-20353","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-44529","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-48788","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-27198","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-36380","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-21762","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-21893","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-46805","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-21887","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-27524","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-29300","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-38203","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-7101","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-49103","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-36844","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-36845","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-36846","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-36847","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-36851","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-22518","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-46604","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-20198","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-44487","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-22515","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-42793","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-3129","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-33246","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-38035","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-26359","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-35081","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-35078","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-29298","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-38205","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-3519","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-20887","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-27997","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-34362","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-27350","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-29492","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-42948","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-39197","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-26360","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-39144","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-28810","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-35914","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-0669","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-22952","state":"stale","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-47966","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-42475","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-26500","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-26501","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-40684","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-36804","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-26258","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-22963","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-39226","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-0028","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-26134","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-20821","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-22947","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-29464","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-31166","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-22965","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-45382","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-1040","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-26085","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2010-2861","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-21973","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2013-0631","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2013-0629","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2013-0625","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2009-3960","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-20708","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-20700","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2013-0632","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-23131","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-24086","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2014-6271","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2014-7169","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-21975","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-22017","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-27860","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-44515","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-35394","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-44228","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-37415","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-44077","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-22204","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-27104","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-27102","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-27103","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2018-4939","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2018-15961","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2017-9805","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2016-4437","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2019-17558","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2020-17530","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2017-5638","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2018-11776","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2019-1653","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2019-11634","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2020-29557","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2017-9822","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2018-7600","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-22205","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2018-6789","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2020-5902","state":"stale","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-22986","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-35464","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2018-13379","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2020-15505","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-34523","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2020-0688","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-34473","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-26858","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-27065","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2019-0604","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2019-18935","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-22893","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-22005","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-21972","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-40539","state":"mapped","mapping_types":["exploitation_technique"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}