Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,240 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
This rule detects attempts to exploit a buffer overflow vulnerability in Tenda routers via the `/goform/exeCommand` endpoint. Specifically, it looks for HTTP POST requests to this URI where the `cmdinput` parameter contains an unusually long string (100 characters or more) which is indicative of an attempt to overflow a buffer.
This rule detects attempts to exploit a command injection vulnerability in the DCN ip_block.php script. It specifically looks for HTTP POST requests to '/function/audit/newstatistics/ip_block.php' with an 'ip' parameter in the request body that contains command injection characters such as semicolons, newlines, backticks, pipes, or dollar signs.
This rule detects attempts to exploit an authentication bypass vulnerability (CVE-2025-54253) in Adobe Experience Manager Forms. The detection is based on specific HTTP URI patterns and content within the request, including '/adminui/updateLicense1.do', 'login. ', and 'debug=command', which are indicative of an exploit attempt against the application.
This rule detects attempts to exploit an XML External Entity (XXE) injection vulnerability in Adobe Experience Manager Forms. The detection logic specifically looks for HTTP POST requests to the '/edcws/services/urn:EDCLicenseService' URI containing '<EDCSecurity>' and '<!ENTITY' patterns in the request body, along with a PCRE regex to identify the XXE payload structure.
This rule detects attempts to exploit an insecure deserialization vulnerability (CVE-2025-49533) in Adobe Experience Manager Forms. The detection is based on specific HTTP URI patterns and content within the request body, looking for '/FormServer/servlet/GetDocumentServlet' followed by 'serDoc=' and 'H4sIAA', which are indicators of a serialized object being sent to the server.
This rule detects attempts to exploit the Zip Slip vulnerability by identifying the sequence '../' within a ZIP archive being uploaded to a server. This pattern indicates an attempt to write files outside the intended directory, potentially leading to arbitrary file overwrite or remote code execution.
This rule detects the presence of the PowerShell cmdlet 'Start-ScheduledTask' within the HTTP response body. This could indicate an attacker attempting to establish persistence on a compromised system by creating scheduled tasks, potentially delivered via a web-based command and control channel or during an exploit.
This rule detects the presence of the PowerShell cmdlet 'Disable-ScheduledTask' within the HTTP response body. This could indicate an attacker attempting to disable scheduled tasks on a compromised system, potentially to remove persistence mechanisms or hinder forensic analysis. The rule specifically looks for a successful HTTP status code (200) and the 'disable-scheduledtask' string, optionally preceded by '-taskname' or '-taskpath'.
This rule detects HTTP GET requests to github.com for PNG files where the User-Agent header contains "WindowsPowerShell". This combination could indicate an attempt to download malicious content or C2 instructions disguised as an image file using PowerShell.
This rule detects attempts to exploit a buffer overflow vulnerability in the `SetNetControlList` function of Tenda routers. Specifically, it looks for HTTP POST requests to the `/goform/SetNetControlList` URI where the `list` parameter in the request body is excessively long (100 characters or more). This vulnerability (CVE-2025-9087, CVE-2025-29215, CVE-2025-1897) could lead to denial of service or arbitrary code execution.
Page 68 of 92