Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
CVEs
71
71
64
58
49
This rule detects attempts to exploit a vulnerability in Xerox FreeFlow Core (CVE-2025-8356) that allows for arbitrary file upload and directory traversal. The detection logic looks for HTTP POST requests with a specific content type ('multipart/related' and 'application/vnd.cip4-jmf+xml') and a 'Content-Disposition: attachment; filename="' header, combined with a PCRE regex matching directory traversal patterns (e.g., '../', '..\'). This indicates an attacker is trying to upload a malicious file or traverse directories on the server.
