Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,460 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (varorg .com)
ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (polimakels .com)
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (prajsm .com)
ET ATTACK_RESPONSE Likely ClickFix Related Staging Domain
This rule detects the 'Zip Slip' vulnerability pattern within incoming TAR archives. Specifically, it looks for the sequence '|00 00 00 2e 2e 5c|' (which represents '..\') within the file data of a POSIX tar archive. This pattern indicates an attempt to extract files outside of the intended directory, potentially leading to directory traversal and arbitrary file overwrite.
ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In iframe
This rule detects the presence of the PowerShell cmdlet 'Set-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web-based mechanism to deliver or execute commands related to scheduled task creation or modification on a compromised system, potentially for persistence.
This rule detects the inbound transfer of an AsyncRAT installer executable over HTTP. It specifically looks for HTTP responses with a content-type of 'application/x-msdownload', a 'content-disposition' header indicating an attachment named 'asyncclient.exe', and the presence of 'cloudflare.com' in the HTTP response body, along with the 'MZ' header indicating a Windows executable.
This rule detects attempts to exploit a known authentication bypass vulnerability in Commvault via QCommand Argument Injection. The detection specifically looks for HTTP POST requests to the '/commandcenter/api/Login' endpoint with specific content in the request body, including '_localadmin__' and 'commserver', along with a PCRE match for '-cs' preceded by a space or URL-encoded space, indicating an attempt to inject arguments.
This rule detects an attempted Server-Side Request Forgery (SSRF) via External XML Entity (XXE) injection targeting Xerox FreeFlow Core. The detection is based on HTTP POST requests containing specific XML and entity declarations indicative of an XXE attack, followed by a SYSTEM entity referencing an HTTP URL, which is characteristic of an SSRF attempt.
Page 65 of 92