Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
CVEs
71
71
64
58
49
IDS Classtypes
1
IDS Protocols
1
This rule detects an attempted remote code execution (RCE) vulnerability in Microsoft SharePoint, specifically CVE-2024-38018. The detection is based on an HTTP POST request targeting the `/_vti_bin/webpartpages.asmx` URI with a specific content pattern in the request body: `|3c|AttachedPropertiesShared|3e 2f|wE`. This pattern indicates an attempt to exploit a deserialization vulnerability within SharePoint's SPThemes functionality.
