Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
4
2
Contributors
6
Categories
6
4
2
2
2
Platforms
4
2
Products / Services
4
4
2
MITRE Techniques
6
6
2
2
CVEs
71
71
64
58
49
IDS Classtypes
4
IDS Protocols
4
This rule detects potential Remote Code Execution (RCE) exploitation attempts targeting Dell Wyse Management Suite (WMS) by identifying abnormally large POST requests containing JSON payloads directed at specific management paths (/WMS/ or /wyse/). This behavior is indicative of an exploit attempt against CVE-2026-41120.
This rule detects potential Remote Code Execution (RCE) exploitation attempts targeting Dell Wyse Management Suite (WMS) by identifying abnormally large POST requests containing JSON payloads directed at specific management paths (/WMS/ or /wyse/). This behavior is indicative of an exploit attempt against CVE-2026-41120.
Detects the transmission of a Windows executable binary file in an HTTP response stream, which may indicate an attempt to exploit vulnerabilities in Dell Wyse Management Suite (CVE-2026-41120 or CVE-2026-49506) by delivering malicious payloads.
Detects the transmission of a Windows executable binary file in an HTTP response stream, which may indicate an attempt to exploit vulnerabilities in Dell Wyse Management Suite (CVE-2026-41120 or CVE-2026-49506) by delivering malicious payloads.
Detects the spawning of suspicious child processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, or mshta.exe) from processes related to the Dell Wyse Management Suite (WMS) service. This behavior is indicative of potential exploitation of CVE-2026-41120, a critical remote code execution vulnerability in the WMS application.
Detects the spawning of suspicious child processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, or mshta.exe) from processes related to the Dell Wyse Management Suite (WMS) service. This behavior is indicative of potential exploitation of CVE-2026-41120, a critical remote code execution vulnerability in the WMS application.