Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
2
1
1
1
Contributors
4
1
Categories
4
3
2
2
2
Platforms
3
2
1
Products / Services
4
2
1
1
MITRE Techniques
4
2
2
2
2
CVEs
71
71
64
58
49
This rule detects activity associated with UNC6201 exploiting Dell RecoverPoint VM (CVE-2026-22769), which involves the SLAYSTYLE/BRICKSTORM/GRIMBOLT malware. It identifies attempts to deploy WAR files via Tomcat Manager, suspicious WAR file uploads or modifications in Tomcat directories on Linux appliances, modifications to a persistence script named 'convert_hosts.sh', network communication with a GRIMBOLT C2 endpoint (149.248.11.71), and specific file hashes linked to the threat actor.
Matches published GRIMBOLT/SLAYSTYLE/BRICKSTORM hashes from RecoverPoint VM intrusions.
This rule detects activities associated with UNC6201 exploitation of Dell RecoverPoint VM, specifically looking for three distinct phases: Tomcat Manager WAR file deployment, modification of a persistence script on Linux, and communication with a GRIMBOLT C2 endpoint. The first part identifies WAR file deployments via Tomcat Manager. The second part looks for modifications to a specific persistence script file. The third part identifies network connections to a known GRIMBOLT C2 IP address or URL pattern.
Detects exploitation attempts of CVE-2026-22769 by identifying PUT requests directed at the Tomcat Manager application deployment endpoint. This is used by UNC6201 to deploy malicious WAR files containing the SLAYSTYLE webshell.
Detects suspicious web requests to the Tomcat Manager on Dell RecoverPoint appliances. This technique is used by UNC6201 to exploit CVE-2026-22769 and upload malicious WAR files.
