Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
2
2
Platforms
2
Products / Services
1
1
1
MITRE Techniques
1
1
1
1
1
CVEs
71
71
64
58
49
Detects attempts to bypass authentication in SolarWinds Web Help Desk by exploiting the page restoration mechanism (CVE-2025-40552, CVE-2025-40554). An attacker can specify a sensitive page via the 'wopage' parameter to gain access to post-authentication functionality without valid credentials.
Detects HTTP POST requests to the SolarWinds Web Help Desk (WHD) AjaxProxy endpoint that contain hex-encoded JSON keys or values (e.g., `\xNN`).
Attackers use this technique to bypass security filters and achieve remote code execution, as detailed in the exploit chain for CVE-2025-40552 and CVE-2025-40553.
Attackers use this technique to bypass security filters and achieve remote code execution, as detailed in the exploit chain for CVE-2025-40552 and CVE-2025-40553.
