Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,461 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
ET ATTACK_RESPONSE ClickFix Webpage Inbound
ET ATTACK_RESPONSE Koi Loader/Stealer Payload Inbound
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (ZXh0LkVuY29k) in DNS TXT Reponse
This rule detects attempts to exploit CVE-2024-30043, a vulnerability in Microsoft SharePoint's SPXmlDataSource that allows for XML External Entity (XXE) injection. The rule specifically looks for HTTP responses containing SharePoint XML data source declarations and a 'DataFile' attribute with a path that starts with 'file://', 'smb://', or '\\', indicating an attempt to fetch local or network files.
This rule detects attempts to exploit a buffer overflow vulnerability in the 'index' parameter of the '/goform/WifiWpsStart' endpoint on Tenda Wifi routers. The detection is triggered by HTTP POST requests to this specific URI containing 'index=' followed by a string of 100 or more characters, indicating an attempt to overflow the buffer. This vulnerability could lead to denial of service or arbitrary code execution.
This rule detects HTTP GET requests for PNG files from github.com with a minimal set of HTTP headers. Specifically, it looks for requests where the total size of HTTP header names is less than 30 bytes and explicitly excludes common headers like 'user-agent', 'referer', 'accept', 'x-auth', and 'cookie'. This pattern could indicate an attempt to exfiltrate data or perform other covert communication using a simplified HTTP client, potentially to evade detection by security tools that expect full browser-like headers.
This rule detects HTTP traffic where the User-Agent string contains the case-insensitive substring 'iot'. This could indicate activity from Internet of Things (IoT) devices, potentially malicious botnet activity, or other suspicious automated traffic originating from or targeting IoT devices.
ET WEB_SPECIFIC_APPS Tenda SysRunCmd getui Parameter Buffer Overflow Attempt (CVE-2025-12622)
ET WEB_SPECIFIC_APPS IPFire dns.cgi TLS_HOSTNAME Parameter Cross Site Scripting Attempt (CVE-2025-34317)
ET WEB_SPECIFIC_APPS IPFire urlfilter.cgi BE_NAME Parameter Command Injection Attempt (CVE-2025-34312)
Page 57 of 92