Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,244 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
This rule detects an attempt to exploit a buffer overflow vulnerability (CVE-2025-9297) in Tenda networking equipment. Specifically, it looks for HTTP POST requests to the '/goform/wxportalauth' URI where the 'type' parameter in the request body contains a string of 100 or more characters, indicating a potential buffer overflow attempt.
This rule detects attempts to exploit a command injection vulnerability in B-Link devices, specifically targeting the `/goform/set_hidessid_cfg` endpoint with the `enable` parameter. Attackers can inject commands by manipulating the `enable` parameter in a POST request, indicated by the presence of command separators like semicolon, newline, backtick, pipe, or dollar sign.
This rule detects inbound network traffic associated with the Braodo Loader malware. It specifically looks for a unique byte sequence and a specific string within the HTTP response body, indicating the download or communication related to this loader.
This rule detects the inbound transfer of a KoiStealer payload over HTTP. It specifically looks for unique string patterns within the HTTP response body that are indicative of the KoiStealer malware, including specific context definitions and keywords like 'CONTEXT_i386', 'CONTEXT_i486', 'CONTEXT_CONTROL', and 'CONTEXT_INTEGER'. This suggests the rule is designed to identify the download of the malware executable or a component of it.
This rule detects the presence of 'activeMQConnectionURL' and 'tcp://' within HTTP response bodies, which is indicative of a Commvault server exposing its hostname or connection details. This information could be leveraged by attackers for reconnaissance or to identify vulnerable Commvault instances.
ET WEB_SPECIFIC_APPS Netgear password.cgi http_passwd Parameter Command Injection Attempt
ET WEB_SPECIFIC_APPS D-Link setMAC macCloneMac Parameter Buffer Overflow Attempt (CVE-2023-43237)
ET MALWARE Observed Malicious Domain (significant-adopted-bearing-own .trycloudflare .com in TLS SNI)
ET MALWARE Observed Malicious Domain (tamku .shoplerter .opnetorologies .net in TLS SNI)
ET MALWARE Observed Malicious Domain (tamku .shop in TLS SNI)
Page 69 of 92