Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
4
Categories
4
2
2
2
Platforms
4
Products / Services
4
4
MITRE Techniques
4
2
2
CVEs
71
71
64
58
49
IDS Classtypes
2
2
IDS Protocols
2
2
Detects outbound TCP traffic originating from the internal network to external hosts on TCP port 45588, which is associated with Interlock ransomware beaconing behavior. This rule monitors for initial TCP SYN packets, characteristic of an outbound connection attempt potentially related to command-and-control activity following the exploitation of CVE-2026-20131.
Detects outbound TCP traffic originating from the internal network to external hosts on TCP port 45588, which is associated with Interlock ransomware beaconing behavior. This rule monitors for initial TCP SYN packets, characteristic of an outbound connection attempt potentially related to command-and-control activity following the exploitation of CVE-2026-20131.
This rule detects HTTP POST requests targeting Cisco Firepower Management Center (FMC) that contain Java exploitation patterns (Runtime.getRuntime or ProcessBuilder) associated with the exploitation of CVE-2026-20131. This activity is indicative of an attempt to achieve Remote Code Execution (RCE) on the FMC appliance, likely by an actor utilizing the Interlock Ransomware threat.
This rule detects HTTP POST requests targeting Cisco Firepower Management Center (FMC) that contain Java exploitation patterns (Runtime.getRuntime or ProcessBuilder) associated with the exploitation of CVE-2026-20131. This activity is indicative of an attempt to achieve Remote Code Execution (RCE) on the FMC appliance, likely by an actor utilizing the Interlock Ransomware threat.