Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
2
2
1
Contributors
3
2
Categories
3
3
2
2
2
Platforms
3
2
Products / Services
2
2
2
MITRE Techniques
2
2
2
2
2
CVEs
71
71
64
58
49
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
This rule detects unauthenticated POST requests with 'Content-Encoding: deflate' in the HTTP header or command line, specifically targeting a vulnerability in SolarWinds Serv-U. The rule aims to identify exploitation attempts related to CVE-2026-28318.
This rule detects unauthenticated POST requests to Serv-U that utilize 'deflate' content encoding, as described in a vendor advisory. It aims to identify exploitation attempts related to CVE-2026-28318 by filtering network events for specific HTTP POST request patterns. The XQL view retains actor and causality fields to aid in investigation.
This rule detects unauthenticated POST requests with 'Content-Encoding: deflate' in the HTTP header or command line, specifically targeting a vulnerability in SolarWinds Serv-U. The rule aims to identify exploitation attempts related to CVE-2026-28318.