Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
2
1
Platforms
2
1
Products / Services
2
2
MITRE Techniques
2
2
1
1
CVEs
71
71
64
58
49
Detects Microsoft Exchange EWS/OWA HTTP requests containing URL-encoded file scheme indicators (e.g., 'file%3a', '%66%69%6c%65'). This activity is associated with attempts to bypass security filters via scheme smuggling, potentially to facilitate Server-Side Request Forgery (SSRF) exploitation leading to unauthorized local file access.
Detects Microsoft Exchange EWS (Exchange.asmx) requests containing a ReferenceAttachment call where the ProviderEndpointUrl parameter points to a non-Microsoft/external domain. This is consistent with SSRF exploitation techniques, such as those observed in CVE-2026-45504, where an attacker-controlled endpoint is provided to Exchange for fetching WOPI properties.