Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
1
1
Contributors
1
1
1
1
1
Categories
3
2
1
1
1
Platforms
3
1
Products / Services
4
1
MITRE Techniques
3
2
1
1
1
CVEs
71
71
64
58
49
Detects files referencing the cloned qassam-315/PAN-OS-User-ID-Buffer-Overflow-PoC GitHub repository for CVE-2026-0300, requiring co-occurrence of the full repo path, repo name, and CVE identifier
This rule detects potential exploitation of Palo Alto PAN-OS vulnerabilities. It monitors for unusual inbound network traffic on ports 6081/6082 from non-RFC1918 (external) IP addresses and identifies specific user-agent strings associated with observed exploit attempts in the wild.
Detects inbound network connections from external, non-private IP addresses to local ports 6081 and 6082. These ports are used by the PAN-OS User-ID Authentication Portal, which is actively targeted by CVE-2026-0300.
Detects the creation of specific file names used by CL-STA-1132 for EarthWorm and ReverseSocks5 tunneling tools in /tmp/ and /var/tmp/ directories on Linux systems. This activity has been observed in CVE-2026-0300 exploitation.
Detects the malformed User-Agent string used by CL-STA-1132 during exploitation
of CVE-2026-0300 (PAN-OS Captive Portal buffer overflow). The UA is structurally
invalid (Safari token precedes Mozilla token, Mozilla/5.5 is non-standard) and
has no known legitimate origin.
of CVE-2026-0300 (PAN-OS Captive Portal buffer overflow). The UA is structurally
invalid (Safari token precedes Mozilla token, Mozilla/5.5 is non-standard) and
has no known legitimate origin.
