Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,459 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
This rule detects attempts to exploit a command injection vulnerability in the DCN ip_block.php script. It specifically looks for HTTP POST requests to '/function/audit/newstatistics/ip_block.php' with an 'ip' parameter in the request body that contains command injection characters such as semicolons, newlines, backticks, pipes, or dollar signs.
This rule detects attempts to exploit a command injection vulnerability in B-Link devices, specifically targeting the `/goform/set_hidessid_cfg` endpoint with the `enable` parameter. Attackers can inject commands by manipulating the `enable` parameter in a POST request, indicated by the presence of command separators like semicolon, newline, backtick, pipe, or dollar sign.
This rule detects attempts to exploit an authentication bypass vulnerability (CVE-2025-54253) in Adobe Experience Manager Forms. The detection is based on specific HTTP URI patterns and content within the request, including '/adminui/updateLicense1.do', 'login. ', and 'debug=command', which are indicative of an exploit attempt against the application.
This rule detects attempts to exploit an XML External Entity (XXE) injection vulnerability in Adobe Experience Manager Forms. The detection logic specifically looks for HTTP POST requests to the '/edcws/services/urn:EDCLicenseService' URI containing '<EDCSecurity>' and '<!ENTITY' patterns in the request body, along with a PCRE regex to identify the XXE payload structure.
This rule detects attempts to exploit an insecure deserialization vulnerability (CVE-2025-49533) in Adobe Experience Manager Forms. The detection is based on specific HTTP URI patterns and content within the request body, looking for '/FormServer/servlet/GetDocumentServlet' followed by 'serDoc=' and 'H4sIAA', which are indicators of a serialized object being sent to the server.
This rule detects the presence of the PowerShell cmdlet 'Start-ScheduledTask' within the HTTP response body. This could indicate an attacker attempting to establish persistence on a compromised system by creating scheduled tasks, potentially delivered via a web-based command and control channel or during an exploit.
This rule detects the presence of the PowerShell cmdlet 'Disable-ScheduledTask' within the HTTP response body. This could indicate an attacker attempting to disable scheduled tasks on a compromised system, potentially to remove persistence mechanisms or hinder forensic analysis. The rule specifically looks for a successful HTTP status code (200) and the 'disable-scheduledtask' string, optionally preceded by '-taskname' or '-taskpath'.
This rule detects the presence of the PowerShell cmdlet 'Enable-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web server to deliver or instruct a client to enable a scheduled task, potentially for persistence or privilege escalation. The detection specifically looks for 'enable-scheduledtask' case-insensitively, optionally preceded by '-taskname' or '-taskpath', within a successful HTTP 200 OK response.
This rule detects attempts to exploit a buffer overflow vulnerability in the `SetNetControlList` function of Tenda routers. Specifically, it looks for HTTP POST requests to the `/goform/SetNetControlList` URI where the `list` parameter in the request body is excessively long (100 characters or more). This vulnerability (CVE-2025-9087, CVE-2025-29215, CVE-2025-1897) could lead to denial of service or arbitrary code execution.
This rule detects an attempt to exploit a buffer overflow vulnerability (CVE-2025-9297) in Tenda networking equipment. Specifically, it looks for HTTP POST requests to the '/goform/wxportalauth' URI where the 'type' parameter in the request body contains a string of 100 or more characters, indicating a potential buffer overflow attempt.
Page 69 of 92