Data Source: Network Traffic

Abnormally Large DNS Response

May 2, 2026 · Use Case: Threat Detection Tactic: Lateral Movement Tactic: Impact Resources: Investigation Guide Use Case: Vulnerability Data Source: PAN-OS Data Source: Network Traffic ·

Share on:

Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.

RDP (Remote Desktop Protocol) from the Internet

May 2, 2026 · Tactic: Command and Control Tactic: Lateral Movement Tactic: Initial Access Domain: Endpoint Use Case: Threat Detection Data Source: PAN-OS Data Source: Network Traffic Resources: Investigation Guide ·

Share on:

This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.

RPC (Remote Procedure Call) to the Internet

May 2, 2026 · Tactic: Initial Access Tactic: Lateral Movement Domain: Endpoint Use Case: Threat Detection Data Source: PAN-OS Data Source: Network Traffic Resources: Investigation Guide ·

Share on:

This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.

SMB (Windows File Sharing) Activity to the Internet

May 2, 2026 · Tactic: Initial Access Tactic: Exfiltration Domain: Network Use Case: Threat Detection Data Source: PAN-OS Data Source: Network Traffic Resources: Investigation Guide ·

Share on:

This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration.

SMTP on Port 26/TCP

May 2, 2026 · Tactic: Command and Control Tactic: Exfiltration Domain: Endpoint Use Case: Threat Detection Data Source: PAN-OS Data Source: Network Traffic Resources: Investigation Guide ·

Share on:

This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems.

Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation

May 1, 2026 · Domain: Endpoint Domain: Web Domain: Network OS: Linux Use Case: Threat Detection Tactic: Initial Access Tactic: Persistence Data Source: Elastic Defend Data Source: Network Traffic Resources: Investigation Guide ·

Share on:

Identifies successful exploitation of CVE-2023-50164, a critical path traversal vulnerability in Apache Struts 2 file upload functionality. This high-fidelity rule detects a specific attack sequence where a malicious multipart/form-data POST request with WebKitFormBoundary is made to a Struts .action upload endpoint, immediately followed by the creation of a JSP web shell file by a Java process in Tomcat's webapps directories. This correlated activity indicates active exploitation resulting in remote code execution capability through unauthorized file upload and web shell deployment.

Initial Access via File Upload Followed by GET Request

Apr 10, 2026 · Domain: Endpoint Domain: Web Domain: Network OS: Linux OS: Windows OS: macOS Use Case: Threat Detection Tactic: Initial Access Tactic: Persistence Data Source: Elastic Defend Data Source: Network Traffic Resources: Investigation Guide ·

Share on:

This rule detects potential initial access activity where an adversary uploads a web shell or malicious script to a web server via a file upload mechanism (e.g., through a web form using multipart/form-data), followed by a GET or POST request to access the uploaded file. By checking the body content of HTTP requests for file upload indicators such as "Content-Disposition: form-data" and "filename=", the rule identifies suspicious upload activities. This sequence of actions is commonly used by attackers to gain and maintain access to compromised web servers.