Aaron Mog
@AaronMogS2S0 followers2,630 downloads339 copies154 likes9,064 views
76 detections
Filters
Last updated
All Time
Detection languages
50
16
10
Categories
19
11
9
8
6
Platforms
28
12
7
5
2
Products / Services
4
4
4
3
3
MITRE Techniques
26
22
22
22
20
CVEs
4
2
1
Detects potential DLL side-loading where the legitimate Palo Alto Networks executable 'PanGpHip.exe' is launched from a non-standard directory and loads 'libwaapi.dll' from the same path. This behavior is consistent with the technique described in the dmpdump report, where an LNK file executes the legitimate application to load a malicious DLL.
Detects potential exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882, which allows for unauthenticated remote code execution. This rule looks for specific web request URIs, post-exploitation process activity, and known indicators of compromise (IOCs).
Detects attempts to exploit CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) by identifying Prototype Pollution vectors (__proto__, constructor) specifically targeting the React Flight protocol (RSC headers/params). Covers both clear-text and common JSON escape sequences. The rule also correlates with 500 errors to identify potential successful exploitation or blind probing attempts.
Detects attempts to exploit CVE-2025-55182 (Next.js/React) via Server Actions. Target is identified by the 'Next-Action' header or 'RSC' markers, combined with JSON prototype pollution vectors in the body.
Detects installed Next.js versions < 16.0.7 vulnerable to CVE-2025-55182 (React Flight RCE)
Detects attempts to exploit CVE-2025-55182 by injecting prototype pollution vectors ("__proto__", "constructor") into React Server Component (RSC) or Next.js Server Action requests. This vulnerability allows for Remote Code Execution via object serialization flaws.
Detects the use of the 'dd' command to write directly to a process's memory space (/proc/<pid>/mem), a technique used by UNC3886 to patch running processes like snmpd and mgd on Juniper routers to disable logging or other functions.
Detects the execution of specific SOQL (Salesforce Object Query Language) queries associated with the UNC6395 data theft campaign. The actor used these queries to enumerate and exfiltrate data from sensitive Salesforce objects.
Detects a user self-assigning access to a large number of applications in Okta within a short time frame. This behavior is associated with the threat group UNC3944 (Scattered Spider) for privilege escalation and lateral movement across SaaS applications.
Detects the PHP variant of the CORNFLAKE.V3 backdoor, which is often dropped as 'config.cfg' and used for C2 communications and payload execution.
Page 1 of 8