Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
6
1
Contributors
6
1
Categories
7
6
1
Platforms
7
Products / Services
6
1
MITRE Techniques
7
7
CVEs
71
71
64
58
49
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
Detects exploitation attempts against Citrix Netscaler, Application Delivery Controller, and Citrix Gateway devices targeting CVE-2019-19781. The rule looks for specific URI query patterns indicative of directory traversal or direct access to vulnerable scripts.
