Aitor Fernández
@aitorsbioCompletionist
0 followers2 downloads57 copies3 likes1,287 views
6 detections
Filters
Last updated
All Time
Detection languages
6
Categories
3
3
2
1
1
Platforms
6
1
1
1
Products / Services
3
2
1
1
MITRE Techniques
3
2
2
1
1
CVEs
3
3
IDS Classtypes
1
This rule identifies Azure Arc-enabled machines running agent versions older than 1.61, which are potentially vulnerable to CVE-2026-26117. It queries Azure Activity logs to extract agent versions and flags machines with outdated agents.
This rule detects unusual modifications to Azure Arc machine identities or Role-Based Access Control (RBAC) assignments following local activity. It specifically looks for 'Write', 'Update', or 'Assign' operations on resources within the 'Microsoft.HybridCompute' resource provider where the properties include 'identity' or 'roleAssignment'. This could indicate an attempt to establish persistence or escalate privileges on hybrid machines.
Detects attempts to exploit CVE-2026-21962, a header spoofing vulnerability in Oracle WebLogic Server. The rule identifies suspicious requests where 'wl-proxy-client-ip' or 'x-forwarded-for' headers contain localhost/loopback addresses or command injection keywords, combined with URI paths related to 'weblogic' or 'proxy'.
Detects exploitation attempts of CVE-2026-21962 (Critical - CVSS 10.0) in Oracle WebLogic Server Proxy Plug-in. The vulnerability allows unauthenticated attackers to bypass access controls via path traversal (patterns like /_proxy/ or /wl_proxy/ + weblogic/..; + ProxyServlet) and header spoofing (WL-Proxy-Client-IP pointing to localhost/127.0.0.1). Successful exploitation can lead to unauthorized access, data modification or full compromise of the backend WebLogic Server.
This rule detects attempts to exploit CVE-2026-21962, a vulnerability in Oracle WebLogic Server. It specifically looks for requests to Application Gateway or Frontdoor logs that contain 'weblogic' in the URI, along with path traversal indicators ('..;', '%2e%2e') or specific proxy paths ('/_proxy/', '/wl_proxy/'), and keywords like 'proxyservlet' or 'bea_wls_internal'. These patterns are indicative of attempts to bypass security controls and access internal resources within a WebLogic environment.
This rule detects privilege escalation events associated with Azure Arc agent processes. It monitors for specific Windows Security Event IDs (4672, 4673, 4674, 4688) where the involved process or its parent is an Azure Arc agent process (himds.exe, azcmagent.exe, gc_worker.exe, gc_service.exe) and the SubjectUserName is not a standard system account. This helps identify potential attempts to elevate privileges using or targeting the Azure Arc agent.