Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
4
Categories
2
2
2
Platforms
2
2
Products / Services
2
2
2
2
2
MITRE Techniques
4
3
1
1
1
CVEs
71
71
64
58
49
Detects an authentication bypass vulnerability (CVE-2021-40539) affecting the REST API URLs in Zoho ManageEngine ADSelfService Plus. The rule specifically looks for requests to vulnerable endpoints that could be used to exploit this flaw.
Detects suspicious access to specific URLs associated with the exploitation of the ADSelfService Plus vulnerability CVE-2021-40539. Attackers have been observed targeting these URLs to exploit the vulnerability.
This rule detects the creation of suspicious shell processes or system utilities spawned by the Java utility 'keytool.exe'. This behavior is often indicative of exploitation, such as the CVE-2021-40539 vulnerability in ManageEngine ADSelfService Plus, where attackers leverage keytool to execute arbitrary commands. The rule specifically looks for 'keytool.exe' as the parent process and a wide range of common Windows and Linux shell/utility executables as the child process.
Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)