Michael Haag dbdbaf8c30 Updated logic for SharePoint EOP ...

Added Web.status=200 Web.http_method=GET to keep it tight.  Based on exploit code available, this will work well.

2023-10-03 07:50:50 -06:00

..

adobe_coldfusion_access_control_bypass.yml

Update adobe_coldfusion_access_control_bypass.yml

2023-08-29 10:24:49 -07:00

adobe_coldfusion_unauthenticated_arbitrary_file_read.yml

updating to gist

2023-09-01 14:14:48 -07:00

citrix_adc_exploitation_cve_2023_3519.yml

woops

2023-07-26 12:48:48 -06:00

citrix_sharefile_exploitation_cve_2023_24489.yml

Update citrix_sharefile_exploitation_cve_2023_24489.yml

2023-07-26 13:37:34 -06:00

confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

detect_attackers_scanning_for_vulnerable_jboss_servers.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

detect_f5_tmui_rce_cve_2020_5902.yml

merged with develop

2023-03-03 12:40:16 +01:00

detect_malicious_requests_to_exploit_jboss_servers.yml

merged with develop

2023-03-03 12:40:16 +01:00

exploit_public_facing_application_via_apache_commons_text.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

fortinet_appliance_auth_bypass.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

hunting_for_log4shell.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml

Ivanti CVE-2023-35082

2023-08-08 10:23:50 -06:00

ivanti_epmm_remote_unauthenticated_api_access.yml

Update ivanti_epmm_remote_unauthenticated_api_access.yml

2023-07-31 14:25:44 -07:00

ivanti_sentry_authentication_bypass.yml

Update ivanti_sentry_authentication_bypass.yml

2023-08-29 10:23:19 -07:00

jetbrains_teamcity_rce_attempt.yml

adding Attacker obs

2023-10-02 08:55:43 -07:00

juniper_networks_remote_code_execution_exploit_detection.yml

Update juniper_networks_remote_code_execution_exploit_detection.yml

2023-09-20 12:06:59 -06:00

log4shell_jndi_payload_injection_attempt.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

log4shell_jndi_payload_injection_with_outbound_connection.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

microsoft_sharepoint_server_elevation_of_privilege.yml

Updated logic for SharePoint EOP

2023-10-03 07:50:50 -06:00

monitor_web_traffic_for_brand_abuse.yml

merged with develop

2023-03-03 12:40:16 +01:00

papercut_ng_remote_web_access_attempt.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

proxyshell_proxynotshell_behavior_detected.yml

blackbyte_campaign

2023-07-10 12:55:29 +02:00

spring4shell_payload_url_request.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

sql_injection_with_long_urls.yml

merged with develop

2023-03-03 12:40:16 +01:00

supernova_webshell.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

vmware_aria_operations_exploit_attempt.yml

Update vmware_aria_operations_exploit_attempt.yml

2023-06-21 13:33:54 -07:00

vmware_server_side_template_injection_hunt.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

vmware_workspace_one_freemarker_server_side_template_injection.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

web_jsp_request_via_url.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

web_spring4shell_http_request_class_module.yml

updating the remainder of yamls

2023-08-21 15:58:35 -07:00

web_spring_cloud_function_functionrouter.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

windows_exchange_autodiscover_ssrf_abuse.yml

blackbyte_campaign

2023-07-10 12:55:29 +02:00

ws_ftp_remote_code_execution.yml

Updated logic for SharePoint EOP

2023-10-03 07:50:50 -06:00