Sponsor of the Day:
Jerkmate
https://detection.fyi/sigmahq/sigma/emerging-threats/2021/exploits/cve-2021-26857/proc_creation_win_exploit_cve_2021_26857_msexchange/
Potential CVE-2021-26857 Exploitation Attempt | Detection.FYI
Detects possible successful exploitation for vulnerability described in CVE-2021-26857 by looking for | abnormal subprocesses spawning by Exchange Server's …
attempt detection fyipotential cve2021exploitation
https://detection.fyi/sigmahq/sigma/emerging-threats/2022/exploits/cve-2022-21587/web_cve_2022_21587_oracle_ebs/
Potential CVE-2022-21587 Exploitation Attempt | Detection.FYI
Detects potential exploitation attempts of CVE-2022-21587 an arbitrary file upload vulnerability impacting Oracle E-Business Suite (EBS). CVE-2022-21587 can …
attempt detection fyipotential cve2022exploitation
https://detection.fyi/sigmahq/sigma/emerging-threats/2023/exploits/cve-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce/
Potential CVE-2023-36884 Exploitation Pattern | Detection.FYI
Detects a unique pattern seen being used by RomCom potentially exploiting CVE-2023-36884
pattern detection fyipotential cve2023exploitation
https://detection.fyi/sigmahq/sigma/emerging-threats/2023/exploits/cve-2023-36874/file_event_win_exploit_cve_2023_36874_wermgr_creation/
Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation | Detection.FYI
Detects the creation of a file named
creation detection fyipotential cve2023exploitationfake
https://detection.fyi/sigmahq/sigma/emerging-threats/2021/exploits/cve-2021-26084/proc_creation_win_exploit_cve_2021_26084_atlassian_confluence/
Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt | Detection.FYI
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084
attempt detection fyiatlassian confluencecve 2021potentialexploitation
https://detection.fyi/sigmahq/sigma/emerging-threats/2023/exploits/cve-2023-34362-moveit-transfer-exploit/web_cve_2023_34362_known_payload_request.yml/
MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request | Detection.FYI
Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362
cve 2023exploitation attemptweb shelldetection fyimoveit
https://detection.fyi/sigmahq/sigma/emerging-threats/2023/exploits/cve-2023-1389/proxy_exploit_cve_2023_1389_unauth_command_injection_tplink_archer_ax21/
CVE-2023-1389 Potential Exploitation Attempt - Unauthenticated Command Injection In TP-Link Archer...
Detects potential exploitation attempt of CVE-2023-1389 an Unauthenticated Command Injection in TP-Link Archer AX21.
cve 2023exploitation attemptcommand injection1389potential