Ali AlEnezi
@siteCompletionist
2 followers45 downloads264 copies6 likes5,288 views
78 detections
Filters
Last updated
All Time
Detection languages
33
30
7
5
2
Categories
31
29
22
11
11
Platforms
40
16
15
14
10
Products / Services
31
30
16
8
6
MITRE Techniques
16
11
9
9
7
CVEs
3
2
2
2
1
IDS Classtypes
10
8
5
4
3
IDS Protocols
23
5
4
1
Detects network traffic patterns indicative of a Netcat-based reverse shell associated with the UAT-11823 (Sandworm) threat group. The rule monitors for characteristic command output such as 'uid=' and 'gid=', shell error strings containing '/bin/sh', and root shell prompts ('root@#') following suspected exploitation of CVE-2026-20079.
Detects an attempt to exploit CVE-2026-42018 in JFrog Artifactory, where an attacker bypasses authentication checks for the AWS token endpoint using a trailing-slash URL manipulation technique. This rule monitors for POST requests to the '/access/api/v1/aws/token/' endpoint.
This rule identifies IoT devices that have reported critical or high severity software vulnerabilities within the last 24 hours. It correlates DeviceTvmSoftwareVulnerabilities data with DeviceInfo to specifically isolate vulnerable IoT-categorized assets and provides a summary of affected devices, software, and the associated CVEs to prioritize remediation efforts.
Detects modifications to credentials associated with Azure AD service principals or applications, such as adding new secrets or certificates. This behavior is commonly associated with attackers maintaining persistence or escalating privileges by creating backdoored credentials.
Detects attempts to disable audit logging features in Microsoft 365, specifically mailbox auditing (via Set-Mailbox) or unified audit log ingestion (via Set-AdminAuditLogConfig). Disabling these features can be a precursor to unauthorized activities, as it prevents the capture of user actions and administrative changes.
This rule aggregates vulnerability data from Microsoft Defender for Endpoint (Threat and Vulnerability Management) over the last 7 days. It groups vulnerable devices by CVE ID and severity level, providing an overview of known software weaknesses currently present across the fleet.
Detects a sequence of activity where an anonymous AWS token is requested via a specific API path, followed within 15 minutes by a token minting call from the same source IP. This behavior is indicative of a token-theft or privilege escalation chain.
Detects the execution of command-line tools (powershell, cmd, bash, curl, etc.) originating from common package managers and build tools (npm, node, pip, python, yarn). The rule flags these processes if they contain command-line arguments indicative of suspicious activity such as base64-encoded commands, remote script execution (IEX, curl/wget to shell), or indicators of persistence mechanisms (scheduled tasks, registry Run keys).
Detects HTTP requests attempting to access 'cmd.jar' on Cisco Firepower Management Center (FMC) devices, which is indicative of post-exploitation activity related to CVE-2026-20079, where an attacker may be attempting to retrieve or upload a command executor.
Detects an attempt to exploit CVE-2026-20079 in Cisco Firepower Management Center (FMC) by targeting the home.jsp file with a specific malicious parameter string indicating post-exploitation activity.
Page 2 of 8