• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    ShadowV2 IoT Vulnerability Exploitation

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Tim Peck@timpeck
    •updated Nov 26, 2025•1•2•82

    Detects HTTP requests attempting to exploit several IoT device vulnerabilities leveraged by the ShadowV2 botnet to spread. This rule looks for specific URI paths and command injection payloads associated with known CVEs.

    YARA-L

    Tags

    TA0001 - Initial AccessT1190 - Exploit Public-Facing ApplicationTA0011 - Command and ControlDS0017 - CommandExploit AttemptNetwork ConnectionNetwork GenericFirmwareZeek IDSSuricata IDSSnort IDSGeneric Network LogCVE-2009-2765CVE-2020-25506CVE-2023-52163CVE-2024-3721CVE-2024-53375SHADOWV2MIRAIIOTEXPLOIT

    Found in

    • Cling Botnet Abusing STUN Infrastructure for C2Last updated 22 days ago
    • Cling Botnet Abusing STUN Infrastructure for C2Last updated 23 days ago
    • Cling Botnet Abusing STUN Infrastructure for C2Last updated 23 days ago
    • Cling Botnet Abusing STUN Infrastructure for C2Last updated 23 days ago
    • Cling Botnet Abusing STUN Infrastructure for C2Last updated 23 days ago
    • Cling Botnet Abusing STUN Infrastructure for C2Last updated 23 days ago
    • Russian-Speaking Operator Toolkits Compromising Ukrainian IP CamerasLast updated Aug 11, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?