Serv-U POST request using deflate encoding
This rule detects unauthenticated POST requests to Serv-U that utilize 'deflate' content encoding, as described in a vendor advisory. It aims to identify exploitation attempts related to CVE-2026-28318 by filtering network events for specific HTTP POST request patterns. The XQL view retains actor and causality fields to aid in investigation.
Cortex XDR
