Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
30 detections
Filters
Last updated
All Time
Detection languages
17
7
6
Contributors
11
8
7
2
1
Categories
18
17
11
7
7
Platforms
15
11
8
1
1
Products / Services
7
6
6
6
5
MITRE Techniques
22
6
6
6
5
CVEs
71
71
64
58
49
30
IDS Classtypes
6
IDS Protocols
5
This rule detects attempts to exploit a Server-Side Request Forgery (SSRF) vulnerability in Oracle PeopleSoft by targeting the '/PSIGW/HttpListeningConnector' endpoint. The detection looks for malicious URI patterns and request bodies containing internal-only network indicators such as loopback addresses (127.0.0.1, localhost), link-local addresses (169.254.169.254), or local file access attempts (file://), which are indicative of SSRF exploitation attempts.
Detects incoming HTTP POST requests to the /PSEMHUB/hub endpoint on Oracle PeopleSoft servers, which is indicative of exploitation attempts related to the Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-35273.
This rule detects attempts to exploit a Server-Side Request Forgery (SSRF) vulnerability in Oracle PeopleSoft by targeting the '/PSIGW/HttpListeningConnector' endpoint. The detection looks for malicious URI patterns and request bodies containing internal-only network indicators such as loopback addresses (127.0.0.1, localhost), link-local addresses (169.254.169.254), or local file access attempts (file://), which are indicative of SSRF exploitation attempts.
Detects post-exploitation system discovery and reconnaissance commands performed by PeopleSoft service accounts (psoft, oracle, linuxadm) on Linux hosts. This activity aligns with observed techniques from the ShinyHunters CVE-2026-35273 campaign, where compromised service accounts were used to map the local environment.
Detects execution of AryStinger or JDY malware as a secondary payload on Oracle PeopleSoft servers, likely following exploitation of CVE-2026-35273 by ShinyHunters. The rule monitors for processes matching these names or anomalous binaries spawned from within the PeopleSoft application directory that are not part of the legitimate application service suite.
Detects unauthenticated HTTP POST requests targeting Oracle PeopleSoft PSEMHUB and PSIGW endpoints that are characteristic of the CVE-2026-35273 remote code execution exploit gadget chain.
Detects unauthorized execution of MeshCentral's meshctrl.js to interface with a local WebSocket endpoint on PeopleSoft servers, likely indicative of session hijacking post-exploitation of CVE-2026-35273 by the ShinyHunters threat group.
Detects automated lateral movement attempts using sshpass to perform password spraying or authentication against PeopleSoft-related service accounts (psoft, oracle, linuxadm). The rule specifically flags the use of sshpass with lax security settings (StrictHostKeyChecking=no), identifying a pattern associated with the uon_fanout.sh post-exploitation script.
Detects external HTTP POST requests to vulnerable Oracle PeopleSoft Environment Management Hub (PSEMHUB) and Integration Broker endpoints. This behavior is associated with UNC6240 (ShinyHunters) zero-day exploitation of CVE-2026-35273.
Page 2 of 2