Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
1
1
1
Categories
3
2
1
1
Platforms
3
Products / Services
2
2
1
1
1
MITRE Techniques
3
2
1
1
1
CVEs
71
71
64
58
49
Detects exploitation attempts against common network edge devices (Cisco, Ivanti, Palo Alto) associated with Salt Typhoon's TTPs for initial access.
The analytic identifies potential exploitation of CVE-2023-20198 in the Web User Interface of Cisco IOS XE software. It detects suspicious activity involving specific URL patterns and HTTP methods, indicative of unauthorized administrative access and potential implant deployment. This activity can lead to full control of the device, compromising its integrity and security.
This rule detects exploitation indicators for CVE-2023-20198, a privilege escalation vulnerability in Cisco IOS XE Software Web UI. It looks for specific log messages related to Web UI installation operations, system configuration changes, or successful web logins, in conjunction with the use of specific user accounts ('cisco_tac_admin', 'cisco_support', 'cisco_sys_manager') that are not typically created by default or used by Cisco representatives. The combination of these events suggests an attempt to exploit the vulnerability.
