Kevin Gandhi
@k3v1nG0 followers24 downloads3 copies0 likes262 views
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Categories
2
1
1
1
1
Platforms
1
1
Products / Services
1
1
1
MITRE Techniques
2
2
1
1
1
CVEs
1
1
Detects exploitation of a remote code execution vulnerability (CVE-2025-61882) in Oracle E-Business Suite. The attack involves an authentication bypass followed by the upload and execution of a malicious XSLT template, leading to command execution and potential web shell deployment.
Detects suspicious command-line activity spawned by the GoAnywhere MFT Tomcat service. This behavior is indicative of post-exploitation techniques observed following the exploitation of CVE-2025-10035, as detailed by Microsoft Threat Intelligence. The detection looks for specific discovery and execution commands launched via cmd.exe or powershell.exe from the GoAnywhere parent process.