Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,261 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
ET INFO DYNAMIC_DNS Query to a *.hornburst .com domain
ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (dotauan .pro)
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (leHQuRW5jb2) in DNS TXT Reponse
This rule detects attempts to exploit the Zip Slip vulnerability by identifying the sequence '../' within a ZIP archive being uploaded to a server. This pattern indicates an attempt to write files outside the intended directory, potentially leading to arbitrary file overwrite or remote code execution.
ET WEB_SPECIFIC_APPS Adobe ColdFusion Access Control Bypass (CVE-2023-38205)
ET WEB_SPECIFIC_APPS Wavlink login.cgi pagelogin Parameter Buffer Overflow Attempt (CVE-2025-61128)
ET WEB_SPECIFIC_APPS Tenda openNetworkGateway wpapsk_crypto2_4g Parameter Buffer Overflow Attempt (CVE-2025-12619)
ET WEB_SPECIFIC_APPS IPFire mail.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34316)
ET WEB_SPECIFIC_APPS IPFire qos.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34310)
ET WEB_SPECIFIC_APPS IPFire firewalllogip.dat pienumber Parameter Cross Site Scripting Attempt (CVE-2025-34307)
Page 53 of 92