Ghost CMS SQLi Filter Probes
Detects unauthenticated SQL injection attempts targeting the Ghost CMS Content API by looking for suspicious slug filter ordering syntax (`slug:[` or its URL-encoded equivalent) in the query string. This rule specifically targets a known vulnerability, CVE-2026-26980.
Microsoft Sentinel (KQL)
