CORS withCredentials Session Hijack via cors_exploit_poc.html (Operation Escaneo)

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•4

This rule detects activities associated with CORS-based exploitation and session token harvesting, specifically targeting the creation or access of known exploit files (e.g., cors_exploit_poc.html) and the use of command-line tools (curl, wget, PowerShell) to interact with suspicious artifacts or session tokens (AMAUTHID/SAT).