Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,461 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (guiasexo .com)
ET ATTACK_RESPONSE Lumma Stealer Payload Inbound
ET ATTACK_RESPONSE Observed ClickFix Landing Page Inbound
ET ATTACK_RESPONSE ClickFix CnC Response (Click Logged Successfully)
ET ATTACK_RESPONSE Unknown Payload Downloader Inbound
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page Inbound
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page (Portuguese)
ET ATTACK_RESPONSE Nishang Invoke-PowerShellTcp Shell Prompt Outbound
This rule detects attempts to exploit multiple command injection vulnerabilities (CVE-2025-9149, CVE-2025-10958, CVE-2025-10960, CVE-2025-10961) in Wavlink wireless.cgi. The detection is based on HTTP POST requests to '/cgi-bin/wireless.cgi' with specific parameters ('Guest_ssid', 'macAddr', or 'delete_list') followed by command injection characters such as semicolon, newline, or backtick.
Detects suspicious access to multiple Azure Storage Accounts using a Shared Access Signature (SAS) token from a single external IP address. This pattern can indicate the use of a compromised, potentially overly permissive, SAS token for reconnaissance or lateral movement.
Page 61 of 92