webserver_generic | Detection.FYI

F5 BIG-IP iControl Rest API Command Execution - Webserver

Oct 1, 2024 · attack.execution attack.t1190 ·
Share on:

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

Read More
Cross Site Scripting Strings

Aug 12, 2024 · attack.initial-access attack.t1189 ·
Share on:

Detects XSS attempts injected via GET requests in access logs

Read More
Java Payload Strings

Aug 12, 2024 · cve.2022-26134 cve.2021-26084 attack.initial-access attack.t1190 ·
Share on:

Detects possible Java payloads in web access logs

Read More
JNDIExploit Pattern

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects exploitation attempt using the JNDI-Exploit-Kit

Read More
Path Traversal Exploitation Attempts

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects path traversal exploitation attempts

Read More
Server Side Template Injection Strings

Aug 12, 2024 · attack.defense-evasion attack.t1221 ·
Share on:

Detects SSTI attempts sent via GET requests in access logs

Read More
Source Code Enumeration Detection by Keyword

Aug 12, 2024 · attack.discovery attack.t1083 ·
Share on:

Detects source code enumeration that use GET requests by keyword searches in URL strings

Read More
SQL Injection Strings In URI

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects potential SQL injection attempts via GET requests in access logs.

Read More
Successful IIS Shortname Fuzzing Scan

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~"

Read More
Suspicious User-Agents Related To Recon Tools

Aug 12, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects known suspicious (default) user-agents related to scanning/recon tools

Read More
Suspicious Windows Strings In URI

Aug 12, 2024 · attack.persistence attack.exfiltration attack.t1505.003 ·
Share on:

Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication

Read More
Webshell ReGeorg Detection Via Web Logs

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.

Read More
Windows Webshell Strings

Aug 12, 2024 · attack.persistence attack.t1505.003 ·
Share on:

Detects common commands used in Windows webshells

Read More