Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
2
1
1
1
Platforms
2
Products / Services
1
1
1
MITRE Techniques
2
2
1
1
1
CVEs
71
71
64
58
49
Detects exploitation attempts against common network edge devices (Cisco, Ivanti, Palo Alto) associated with Salt Typhoon's TTPs for initial access.
The following analytic detects potential unauthorized access attempts exploiting CVE-2023-35082 within Ivanti's software products. It identifies access to the specific URI path /mifs/asfV3/api/v2/ with an HTTP 200 response code in web access logs, indicating successful unauthorized access. This activity is significant for a SOC as it highlights potential security breaches that could lead to unauthorized data access or system modifications. If confirmed malicious, an attacker could gain unbridled access to sensitive organizational data or modify systems maliciously, posing severe security risks.
