Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
5
4
Contributors
9
Categories
5
5
5
5
4
Platforms
9
9
4
Products / Services
5
4
4
MITRE Techniques
5
5
4
4
CVEs
68
68
63
58
50
IDS Classtypes
4
IDS Protocols
4
This rule detects indicator of compromise (IOC) sweep events associated with the AhsayCBS campaign (CVE-2026-105133 and CVE-2026-105134) involving XMRig cryptominer activity. It checks for specific file and process SHA256 hashes, remote IP addresses, and domain connections related to known mining pools or attacker infrastructure using Sentinel Device tables.
This rule detects indicator of compromise (IOC) sweep events associated with the AhsayCBS campaign (CVE-2026-105133 and CVE-2026-105134) involving XMRig cryptominer activity. It checks for specific file and process SHA256 hashes, remote IP addresses, and domain connections related to known mining pools or attacker infrastructure using Sentinel Device tables.
This rule detects indicator of compromise (IOC) sweep events associated with the AhsayCBS campaign (CVE-2026-105133 and CVE-2026-105134) involving XMRig cryptominer activity. It checks for specific file and process SHA256 hashes, remote IP addresses, and domain connections related to known mining pools or attacker infrastructure using Sentinel Device tables.
This rule detects indicator of compromise (IOC) sweep events associated with the AhsayCBS campaign (CVE-2026-105133 and CVE-2026-105134) involving XMRig cryptominer activity. It checks for specific file and process SHA256 hashes, remote IP addresses, and domain connections related to known mining pools or attacker infrastructure using Sentinel Device tables.
This rule detects indicator of compromise (IOC) sweep events associated with the AhsayCBS campaign (CVE-2026-105133 and CVE-2026-105134) involving XMRig cryptominer activity. It checks for specific file and process SHA256 hashes, remote IP addresses, and domain connections related to known mining pools or attacker infrastructure using Sentinel Device tables.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.