Files

.github
.gitlab
.vscode
app_template
baselines
dashboards
data_sources
deployments
detections
- application
- cloud
- deprecated
- endpoint
- network
- web
  - access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml
  - adobe_coldfusion_access_control_bypass.yml
  - adobe_coldfusion_unauthenticated_arbitrary_file_read.yml
  - cisco_ios_xe_implant_access.yml
  - citrix_adc_and_gateway_unauthorized_data_disclosure.yml
  - citrix_adc_exploitation_cve_2023_3519.yml
  - citrix_sharefile_exploitation_cve_2023_24489.yml
  - confluence_cve_2023_22515_trigger_vulnerability.yml
  - confluence_data_center_and_server_privilege_escalation.yml
  - confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml
  - confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml
  - connectwise_screenconnect_authentication_bypass.yml
  - detect_attackers_scanning_for_vulnerable_jboss_servers.yml
  - detect_f5_tmui_rce_cve_2020_5902.yml
  - detect_malicious_requests_to_exploit_jboss_servers.yml
  - detect_remote_access_software_usage_url.yml
  - detect_web_access_to_decommissioned_s3_bucket.yml
  - exploit_public_facing_application_via_apache_commons_text.yml
  - exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml
  - f5_tmui_authentication_bypass.yml
  - fortinet_appliance_auth_bypass.yml
  - high_volume_of_bytes_out_to_url.yml
  - hunting_for_log4shell.yml
  - ivanti_connect_secure_command_injection_attempts.yml
  - ivanti_connect_secure_ssrf_in_saml_component.yml
  - ivanti_connect_secure_system_information_access_via_auth_bypass.yml
  - ivanti_epm_sql_injection_remote_code_execution.yml
  - ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml
  - ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml
  - ivanti_sentry_authentication_bypass.yml
  - java_class_file_download_by_java_user_agent.yml
  - jenkins_arbitrary_file_read_cve_2024_23897.yml
  - jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml
  - jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198.yml
  - jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199.yml
  - jetbrains_teamcity_rce_attempt.yml
  - juniper_networks_remote_code_execution_exploit_detection.yml
  - log4shell_jndi_payload_injection_attempt.yml
  - log4shell_jndi_payload_injection_with_outbound_connection.yml
  - microsoft_sharepoint_server_elevation_of_privilege.yml
  - monitor_web_traffic_for_brand_abuse.yml
  - multiple_archive_files_http_post_traffic.yml
  - nginx_connectwise_screenconnect_authentication_bypass.yml
  - papercut_ng_remote_web_access_attempt.yml
  - plain_http_post_exfiltrated_data.yml
  - proxyshell_proxynotshell_behavior_detected.yml
  - spring4shell_payload_url_request.yml
  - sql_injection_with_long_urls.yml
  - supernova_webshell.yml
  - tomcat_session_deserialization_attempt.yml
  - tomcat_session_file_upload_attempt.yml
  - unusually_long_content_type_length.yml
  - vmware_aria_operations_exploit_attempt.yml
  - vmware_server_side_template_injection_hunt.yml
  - vmware_workspace_one_freemarker_server_side_template_injection.yml
  - web_jsp_request_via_url.yml
  - web_remote_shellservlet_access.yml
  - web_spring4shell_http_request_class_module.yml
  - web_spring_cloud_function_functionrouter.yml
  - windows_exchange_autodiscover_ssrf_abuse.yml
  - windows_iis_server_pswa_console_access.yml
  - wordpress_bricks_builder_plugin_rce.yml
  - ws_ftp_remote_code_execution.yml
  - zscaler_adware_activities_threat_blocked.yml
  - zscaler_behavior_analysis_threat_blocked.yml
  - zscaler_cryptominer_downloaded_threat_blocked.yml
  - zscaler_employment_search_web_activity.yml
  - zscaler_exploit_threat_blocked.yml
  - zscaler_legal_liability_threat_blocked.yml
  - zscaler_malware_activity_threat_blocked.yml
  - zscaler_phishing_activity_threat_blocked.yml
  - zscaler_potentially_abused_file_download.yml
  - zscaler_privacy_risk_destinations_threat_blocked.yml
  - zscaler_scam_destinations_threat_blocked.yml
  - zscaler_virus_download_threat_blocked.yml
dist
docs
lookups
macros
notebooks
playbooks
removed
stories
workbooks
.gitignore
.gitpod.yml
.pre-commit-config.yaml
CODE_OF_CONDUCT.md
LICENSE
README.md
SECURITY.md
contentctl.yml

web

Merge branch 'develop' into output_normalization_endpoint

Apr 1, 2025

00253f3 · Apr 1, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Files

web

web

Name	Name	Last commit message	Last commit date
parent directory ..
access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml	access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
adobe_coldfusion_access_control_bypass.yml	adobe_coldfusion_access_control_bypass.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
adobe_coldfusion_unauthenticated_arbitrary_file_read.yml	adobe_coldfusion_unauthenticated_arbitrary_file_read.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
cisco_ios_xe_implant_access.yml	cisco_ios_xe_implant_access.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
citrix_adc_and_gateway_unauthorized_data_disclosure.yml	citrix_adc_and_gateway_unauthorized_data_disclosure.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
citrix_adc_exploitation_cve_2023_3519.yml	citrix_adc_exploitation_cve_2023_3519.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
citrix_sharefile_exploitation_cve_2023_24489.yml	citrix_sharefile_exploitation_cve_2023_24489.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
confluence_cve_2023_22515_trigger_vulnerability.yml	confluence_cve_2023_22515_trigger_vulnerability.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
confluence_data_center_and_server_privilege_escalation.yml	confluence_data_center_and_server_privilege_escalation.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml	confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml	confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
connectwise_screenconnect_authentication_bypass.yml	connectwise_screenconnect_authentication_bypass.yml	The Haag Identity: Operation Seashell Blizzard 🌊❄️	Mar 24, 2025
detect_attackers_scanning_for_vulnerable_jboss_servers.yml	detect_attackers_scanning_for_vulnerable_jboss_servers.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
detect_f5_tmui_rce_cve_2020_5902.yml	detect_f5_tmui_rce_cve_2020_5902.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
detect_malicious_requests_to_exploit_jboss_servers.yml	detect_malicious_requests_to_exploit_jboss_servers.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
detect_remote_access_software_usage_url.yml	detect_remote_access_software_usage_url.yml	update versions	Mar 14, 2025
detect_web_access_to_decommissioned_s3_bucket.yml	detect_web_access_to_decommissioned_s3_bucket.yml	Update detect_web_access_to_decommissioned_s3_bucket.yml	Feb 20, 2025
exploit_public_facing_application_via_apache_commons_text.yml	exploit_public_facing_application_via_apache_commons_text.yml	Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT…	Feb 10, 2025
exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml	exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
f5_tmui_authentication_bypass.yml	f5_tmui_authentication_bypass.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
fortinet_appliance_auth_bypass.yml	fortinet_appliance_auth_bypass.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
high_volume_of_bytes_out_to_url.yml	high_volume_of_bytes_out_to_url.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
hunting_for_log4shell.yml	hunting_for_log4shell.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
ivanti_connect_secure_command_injection_attempts.yml	ivanti_connect_secure_command_injection_attempts.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
ivanti_connect_secure_ssrf_in_saml_component.yml	ivanti_connect_secure_ssrf_in_saml_component.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
ivanti_connect_secure_system_information_access_via_auth_bypass.yml	ivanti_connect_secure_system_information_access_via_auth_bypass.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
ivanti_epm_sql_injection_remote_code_execution.yml	ivanti_epm_sql_injection_remote_code_execution.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml	ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml	ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
ivanti_sentry_authentication_bypass.yml	ivanti_sentry_authentication_bypass.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
java_class_file_download_by_java_user_agent.yml	java_class_file_download_by_java_user_agent.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
jenkins_arbitrary_file_read_cve_2024_23897.yml	jenkins_arbitrary_file_read_cve_2024_23897.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml	jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198.yml	jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199.yml	jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
jetbrains_teamcity_rce_attempt.yml	jetbrains_teamcity_rce_attempt.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
juniper_networks_remote_code_execution_exploit_detection.yml	juniper_networks_remote_code_execution_exploit_detection.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
log4shell_jndi_payload_injection_attempt.yml	log4shell_jndi_payload_injection_attempt.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
log4shell_jndi_payload_injection_with_outbound_connection.yml	log4shell_jndi_payload_injection_with_outbound_connection.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
microsoft_sharepoint_server_elevation_of_privilege.yml	microsoft_sharepoint_server_elevation_of_privilege.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
monitor_web_traffic_for_brand_abuse.yml	monitor_web_traffic_for_brand_abuse.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
multiple_archive_files_http_post_traffic.yml	multiple_archive_files_http_post_traffic.yml	Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT…	Feb 10, 2025
nginx_connectwise_screenconnect_authentication_bypass.yml	nginx_connectwise_screenconnect_authentication_bypass.yml	The Haag Identity: Operation Seashell Blizzard 🌊❄️	Mar 24, 2025
papercut_ng_remote_web_access_attempt.yml	papercut_ng_remote_web_access_attempt.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
plain_http_post_exfiltrated_data.yml	plain_http_post_exfiltrated_data.yml	Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT…	Feb 10, 2025
proxyshell_proxynotshell_behavior_detected.yml	proxyshell_proxynotshell_behavior_detected.yml	The Haag Identity: Operation Seashell Blizzard 🌊❄️	Mar 24, 2025
spring4shell_payload_url_request.yml	spring4shell_payload_url_request.yml	Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT…	Feb 10, 2025
sql_injection_with_long_urls.yml	sql_injection_with_long_urls.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
supernova_webshell.yml	supernova_webshell.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
tomcat_session_deserialization_attempt.yml	tomcat_session_deserialization_attempt.yml	fixagai	Apr 1, 2025
tomcat_session_file_upload_attempt.yml	tomcat_session_file_upload_attempt.yml	fixagai	Apr 1, 2025
unusually_long_content_type_length.yml	unusually_long_content_type_length.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
vmware_aria_operations_exploit_attempt.yml	vmware_aria_operations_exploit_attempt.yml	Finish removing extra fields, or renaming	Jan 3, 2025
vmware_server_side_template_injection_hunt.yml	vmware_server_side_template_injection_hunt.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
vmware_workspace_one_freemarker_server_side_template_injection.yml	vmware_workspace_one_freemarker_server_side_template_injection.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
web_jsp_request_via_url.yml	web_jsp_request_via_url.yml	Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT…	Feb 10, 2025
web_remote_shellservlet_access.yml	web_remote_shellservlet_access.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
web_spring4shell_http_request_class_module.yml	web_spring4shell_http_request_class_module.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
web_spring_cloud_function_functionrouter.yml	web_spring_cloud_function_functionrouter.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
windows_exchange_autodiscover_ssrf_abuse.yml	windows_exchange_autodiscover_ssrf_abuse.yml	The Haag Identity: Operation Seashell Blizzard 🌊❄️	Mar 24, 2025
windows_iis_server_pswa_console_access.yml	windows_iis_server_pswa_console_access.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
wordpress_bricks_builder_plugin_rce.yml	wordpress_bricks_builder_plugin_rce.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
ws_ftp_remote_code_execution.yml	ws_ftp_remote_code_execution.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
zscaler_adware_activities_threat_blocked.yml	zscaler_adware_activities_threat_blocked.yml	updating versions	Feb 5, 2025
zscaler_behavior_analysis_threat_blocked.yml	zscaler_behavior_analysis_threat_blocked.yml	updating versions	Feb 5, 2025
zscaler_cryptominer_downloaded_threat_blocked.yml	zscaler_cryptominer_downloaded_threat_blocked.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
zscaler_employment_search_web_activity.yml	zscaler_employment_search_web_activity.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
zscaler_exploit_threat_blocked.yml	zscaler_exploit_threat_blocked.yml	updating versions	Feb 5, 2025
zscaler_legal_liability_threat_blocked.yml	zscaler_legal_liability_threat_blocked.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
zscaler_malware_activity_threat_blocked.yml	zscaler_malware_activity_threat_blocked.yml	updating versions	Feb 5, 2025
zscaler_phishing_activity_threat_blocked.yml	zscaler_phishing_activity_threat_blocked.yml	remove update_timestamps, confidence, impact,	Jan 3, 2025
zscaler_potentially_abused_file_download.yml	zscaler_potentially_abused_file_download.yml	updating versions	Feb 5, 2025
zscaler_privacy_risk_destinations_threat_blocked.yml	zscaler_privacy_risk_destinations_threat_blocked.yml	updating versions	Feb 5, 2025
zscaler_scam_destinations_threat_blocked.yml	zscaler_scam_destinations_threat_blocked.yml	updating versions	Feb 5, 2025
zscaler_virus_download_threat_blocked.yml	zscaler_virus_download_threat_blocked.yml	updating versions	Feb 5, 2025

Files

web

Directory actions

More options

Directory actions

More options

Latest commit

History

web

Folders and files

parent directory