Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
6
2
1
Contributors
7
2
Categories
8
7
1
1
1
Platforms
8
1
Products / Services
6
2
MITRE Techniques
2
1
1
1
1
CVEs
71
71
64
58
49
This rule detects potential exploitation attempts against Grandstream GXP1600 series IP phones related to CVE-2026-2329. It specifically looks for HTTP requests to the '/cgi-bin/api.values.get' endpoint where the 'request' parameter in the URI query string has a length greater than or equal to 65 characters, which could indicate an attempt to trigger a buffer overflow or similar vulnerability.
This rule detects potential exploitation attempts against Grandstream GXP1600 series IP phones targeting CVE-2026-2329. It specifically looks for HTTP requests to the `/cgi-bin/api.values.get` endpoint where the `request` parameter in the URI query string has a length greater than or equal to 65 characters, which is indicative of an oversized request parameter often used in buffer overflow or similar vulnerabilities.
This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 VoIP phones. The detection is based on requests to the '/cgi-bin/api.values.get' URI path, which is associated with the vulnerability.
This rule detects HTTP requests targeting the '/cgi-bin/api.values.get' endpoint with a 'request' parameter, which is indicative of exploitation attempts for CVE-2026-2329 in Grandstream GXP1600 series IP phones. This vulnerability allows for information disclosure.
Detects likely exploitation attempts for CVE-2026-2329 by matching requests to /cgi-bin/api.values.get where the first identifier in the request= parameter exceeds the 64-byte stack buffer described by Rapid7.
This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 series VoIP phones. The detection logic specifically looks for HTTP requests to the '/cgi-bin/api.values.get' endpoint, with a particular focus on the 'request' parameter within the query string. A request parameter with a length greater than or equal to 65 characters is indicative of a potential exploit attempt, as this length is likely to trigger the buffer overflow.
This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 VoIP phones. The detection logic looks for HTTP requests to the vulnerable endpoint '/cgi-bin/api.values.get' and specifically for an oversized 'request' parameter where the first identifier before a colon is 65 characters or longer, indicating a likely buffer overflow attempt.
Detects potential reverse shell activity originating from a Grandstream VoIP device. This is a high-fidelity indicator of compromise following the successful exploitation of CVE-2026-2329. This version uses DeviceNetworkEvents.
Detects potential exploitation attempts against a buffer overflow vulnerability (CVE-2026-2329) in Grandstream VoIP phones. This rule identifies web requests targeting the vulnerable API endpoint '/cgi-bin/api.values.get' with an overly long query string (>64 bytes) or the use of multiple colons (>=3) which could indicate a ROP chain attempt. The detection is based on DeviceNetworkEvents from Microsoft Defender for Endpoint.