Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
2
1
1
1
1
Platforms
3
1
Products / Services
1
1
1
MITRE Techniques
2
1
1
1
CVEs
71
71
64
58
49
Experimental CommonSecurityLog template for sensor-reported attempts associated with Cisco advisory cisco-sa-ise-rce-se7bYU57: CVE-2026-20307, CVE-2026-20176 and CVE-2026-20211. Cisco links Snort SIDs 67114, 67115, 67116 and 67130-67132. Configure exact exporter event IDs, sensor vendor/product and confirmed ISE management IPs. A match does not prove successful exploitation or root compromise.
Experimental behavioral hunt for a root-owned shell or interpreter started by a non-root initiating account on explicitly inventoried ISE devices. This identifies an account-context transition in process telemetry; it does not establish preceding exploitation, setuid abuse, or a specific Cisco CVE. Requires verified appliance process telemetry.
Experimental behavioral hunt for a Java process directly spawning a root-owned shell or selected command-line utility on explicitly inventoried ISE devices. Potential post-exploitation signal relevant to ISE Java RCE investigations. It does not prove Java deserialization or identify CVE-2026-20307/20211, and requires verified appliance process telemetry.