Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
4
3
3
1
Contributors
5
2
1
1
1
Categories
10
7
4
3
1
Platforms
5
3
3
Products / Services
8
4
2
2
1
MITRE Techniques
9
8
6
3
2
CVEs
71
71
64
58
49
IDS Classtypes
4
IDS Protocols
4
Detects web application server processes (such as IIS, Apache, Tomcat, Java, Nginx, or Node.js) spawning command-line interpreters or system utilities. This behavior is frequently associated with webshell execution or post-exploitation activities following the exploitation of a public-facing application, often seen in VPN or enterprise software compromises.
Detects suspicious child processes spawned by a Java process, which may indicate post-exploitation activity related to the Oracle E-Business Suite vulnerability CVE-2025-61882. The exploit chain often results in a reverse shell.
Detects files associated with the Cl0p ransomware group's exploitation of the Oracle E-Business Suite vulnerability (CVE-2025-61882).
Detects potential exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882, which allows for unauthenticated remote code execution. This rule looks for specific web request URIs, post-exploitation process activity, and known indicators of compromise (IOCs).
Detects exploitation of a remote code execution vulnerability (CVE-2025-61882) in Oracle E-Business Suite. The attack involves an authentication bypass followed by the upload and execution of a malicious XSLT template, leading to command execution and potential web shell deployment.
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Authentication Bypass (SyncServlet) (CVE-2025-61882)
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Template Manager Template Copy (CVE-2025-61882)
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Unauthenticated Template Manager Template Preview (CVE-2025-61882)
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Template Manager Template File Add (CVE-2025-61882)
Detects potential remote code execution associated with the exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882 on Windows hosts. The rule looks for a Java process spawning a command shell to execute reconnaissance commands, followed by an outbound network connection from the same Java process within a short time frame. This behavior is consistent with post-exploitation activity observed in the campaign.
Detects a potential Oracle E-Business Suite (EBS) authentication bypass attempt, associated with the exploitation of CVE-2025-61882. This activity involves an HTTP POST request to the '/OA_HTML/SyncServlet' endpoint, which is the initial step observed in the exploit chain used by threat actors like GRACEFUL SPIDER.