David Wharton
@whartond2 followers159 downloads45 copies16 likes1,894 views
14 detections
Filters
Last updated
All Time
Detection languages
10
3
1
Categories
11
10
4
1
1
Platforms
11
3
1
1
Products / Services
10
1
1
1
1
MITRE Techniques
7
6
4
3
3
CVEs
6
2
1
IDS Classtypes
9
1
IDS Protocols
10
This rule detects an inbound HTTP POST request targeting the Langflow AI pipeline application, specifically looking for attempts to exploit CVE-2026-33017. The detection logic focuses on specific URI paths and keywords within the HTTP request body that indicate an attempt to inject code, such as 'import '.
This rule detects an inbound HTTP POST request targeting the Langflow AI pipeline application, specifically looking for attempts to exploit CVE-2026-33017. The detection logic focuses on specific URI paths and keywords within the HTTP request body that indicate an attempt to inject code, such as 'import '.
This rule detects an attempt to exploit an XML External Entity (XXE) vulnerability in GeoServer's Web Map Service (WMS) GetMap function. The detection logic looks for HTTP POST requests to the '/wms?' endpoint containing 'request=GetMap' in the URI, and specific XML elements like '<StyledLayerDescriptor>', '<!DOCTYPE', '<!ENTITY', and 'SYSTEM' within the request body, along with a URL-like pattern '://' indicating an attempt to fetch external content.
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
This rule detects a possible Remote Code Execution (RCE) attempt targeting a React application, specifically exploiting CVE-2025-55182. It looks for inbound HTTP POST requests containing 'child_process' and 'response' and 'Sync' in the request body, along with specific HTTP headers ('Next-Action', 'rsc-action-id', or 'text/x-component'). The presence of 'child_process' suggests an attempt to execute system commands.
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
This rule detects outbound HTTP traffic where the User-Agent header contains the string 'Internet Explorer'. This has been seen used by malware, and the legitimate Internet Explorer browser uses the User-Agent string "MSIE". The MSIE browser was end-of-lifed in 2022. The rule specifically looks for this pattern in established, to_server HTTP flows.
Page 1 of 2