Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
This rule detects attempts to exploit the Zip Slip vulnerability by identifying ZIP archive uploads containing directory traversal sequences ('../') within filenames. This technique allows attackers to write files outside the intended extraction directory, potentially leading to arbitrary file overwrite or remote code execution.
This rule detects the 'Zip Slip' vulnerability pattern within TAR archive uploads. Specifically, it looks for the sequence '../' (dot dot slash) in the file data of a TAR archive, which indicates an attempt to traverse directories and potentially write files outside the intended extraction directory. This is a common technique used in Zip Slip attacks to achieve arbitrary file write.
This rule detects attempts to exploit the Zip Slip vulnerability by identifying the sequence '../' within a ZIP archive being uploaded to a server. This pattern indicates an attempt to write files outside the intended directory, potentially leading to arbitrary file overwrite or remote code execution.
This rule detects the 'Zip Slip' vulnerability pattern within incoming TAR archives. Specifically, it looks for the sequence '|00 00 00 2e 2e 5c|' (which represents '..\') within the file data of a POSIX tar archive. This pattern indicates an attempt to extract files outside of the intended directory, potentially leading to directory traversal and arbitrary file overwrite.
This rule detects attempts to exploit the Zip Slip vulnerability by identifying the sequence '../' within a ZIP archive being uploaded to a server. This pattern indicates an attempt to write files outside the intended directory, potentially leading to arbitrary file overwrite or remote code execution.
This rule detects attempts to exploit the Zip Slip vulnerability within TAR archives. Specifically, it looks for the sequence `../` (dot dot slash) in file paths within a TAR archive being transferred to a client, which is indicative of an attacker trying to write files outside of the intended directory.
This rule detects attempts to exploit the Zip Slip vulnerability in inbound ZIP archives. It specifically looks for the sequence '../' within the file data of a ZIP archive, which indicates an attempt to write files outside of the intended directory during extraction.
Page 42 of 42