Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
3
2
1
Platforms
3
2
Products / Services
3
MITRE Techniques
3
3
2
2
CVEs
71
71
64
58
49
Detects potential exploitation attempts targeting Ruckus devices using known CVEs.
Detects network logs identifying exploitation attempts or vulnerability scans targeting known Ruckus Wireless vulnerabilities (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717). The rule parses CommonSecurityLog entries where the device, message, or activity fields contain references to these specific vulnerabilities.
Detects a potential exploitation attempt of CVE-2023-25717, a Remote Code Execution vulnerability via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin. The rule looks for specific URI query parameters including '/forms/doLogin', 'login_username', 'password', and the presence of '$(' or its URL-encoded version '%24%28', which are indicative of command injection.
