Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
5
3
Contributors
8
Categories
8
7
3
1
1
Platforms
7
2
1
Products / Services
5
5
5
3
3
MITRE Techniques
8
2
2
CVEs
71
71
64
58
49
IDS Classtypes
2
1
IDS Protocols
2
1
Detects anomalous, high-volume unauthenticated POST requests to the Elementor Pro 'admin-ajax.php' endpoint with the 'elementor_pro_forms_send_form' action. This behavior is indicative of potential exploitation attempts or reconnaissance associated with the Elementor Pro file upload vulnerability (CVE-2026-32475).
KQL Query from file: repeated-unauthenticated-post-to-elementor-pro-forms-endpoint-cve-2026-32475-pr.kql
Detects anomalous, high-volume unauthenticated POST requests to the Elementor Pro 'admin-ajax.php' endpoint with the 'elementor_pro_forms_send_form' action. This behavior is indicative of potential exploitation attempts or reconnaissance associated with the Elementor Pro file upload vulnerability (CVE-2026-32475).
Detects anomalous, high-volume unauthenticated POST requests to the Elementor Pro 'admin-ajax.php' endpoint with the 'elementor_pro_forms_send_form' action. This behavior is indicative of potential exploitation attempts or reconnaissance associated with the Elementor Pro file upload vulnerability (CVE-2026-32475).
Detects anomalous, high-volume unauthenticated POST requests to the Elementor Pro 'admin-ajax.php' endpoint with the 'elementor_pro_forms_send_form' action. This behavior is indicative of potential exploitation attempts or reconnaissance associated with the Elementor Pro file upload vulnerability (CVE-2026-32475).
Detects incoming HTTP POST requests targeting the 'admin-ajax.php' endpoint with parameters associated with a malicious file upload exploit against Elementor Pro (CVE-2026-32475). The rule specifically looks for the 'elementor_pro_forms_send_form' action and the presence of PHP file extensions within form fields, indicating an attempt to upload a web shell.
Detects a malicious HTTP POST request targeting the Elementor Pro WordPress plugin's 'elementor_pro_forms_send_form' action. The rule looks for a specific attempt to bypass file upload restrictions by manipulating the array index of form fields to upload a PHP file via the 'admin-ajax.php' endpoint.
Detects inbound network traffic originating from IP addresses known to be associated with exploitation attempts targeting the Elementor Pro CVE-2026-32475 vulnerability. This rule monitors for connections to internal network assets from these identified threat actor sources.