Data Source: Suricata

Splunk Enterprise PostgreSQL Backup-to-Restore Potential RCE Sequence

Jul 2, 2026 · Domain: Network Use Case: Threat Detection Use Case: Vulnerability Use Case: Network Security Monitoring Tactic: Initial Access Data Source: Network Packet Capture Data Source: Network Traffic Data Source: Zeek Data Source: Suricata Resources: Investigation Guide ·

Share on:

Detects a POST to the Splunk Enterprise PostgreSQL backup endpoint followed by a POST to the restore endpoint from the same client to the same host within a 15-minute window. This sequence is unusual and can align with the public CVE-2026-20253 pre-authentication RCE chain, where an attacker stages a database dump via the backup path and executes attacker-controlled SQL via the restore path.

Splunk Enterprise PostgreSQL Recovery Endpoint Injection Artifacts

Jul 2, 2026 · Domain: Network Use Case: Threat Detection Use Case: Vulnerability Use Case: Network Security Monitoring Tactic: Initial Access Data Source: Azure Data Source: Elastic Defend Data Source: GCP Data Source: Google Cloud Platform Data Source: Network Packet Capture Data Source: Network Traffic Data Source: Zeek Data Source: Suricata Resources: Investigation Guide ·

Share on:

Detects CVE-2026-20253 exploit artifacts against the Splunk Enterprise PostgreSQL sidecar recovery endpoints via complementary signals. Where endpoint or Network Packet Capture request-body logging is available, the rule matches PostgreSQL connection-string injection keywords, suspicious backupFile destinations, and known filesystem artifacts used to pivot from backup/restore primitives to file write or RCE. It also detects vulnerable recovery endpoint probing and empty-password Basic auth credentials observed in public exploit tooling.

Accepted Default Telnet Port Connection

Jun 24, 2026 · Domain: Endpoint Use Case: Threat Detection Tactic: Command and Control Tactic: Lateral Movement Tactic: Initial Access Data Source: Fortinet Data Source: PAN-OS Data Source: pfSense Data Source: SonicWall Data Source: Suricata Resources: Investigation Guide ·

Share on:

This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embedded systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic.

React2Shell Network Security Alert

Apr 10, 2026 · Domain: Network Domain: Application Domain: Web Use Case: Threat Detection Use Case: Vulnerability Tactic: Initial Access Tactic: Execution Data Source: PAN-OS Data Source: Fortinet Data Source: Suricata Data Source: Cisco FTD Resources: Investigation Guide ·

Share on:

This rule identifies network security alerts related to CVE-2025-55182 exploitation attempts from different network security integrations. CVE-2025-55182 is a critical remote code execution vulnerability in React Server Components (RSC) Flight protocol. The vulnerability allows attackers to execute arbitrary code on the server by sending specially crafted deserialization payloads that exploit prototype chain traversal to access the Function constructor.

Suricata and Elastic Defend Network Correlation

Apr 10, 2026 · Domain: Endpoint Domain: Network OS: Linux OS: Windows OS: macOS Use Case: Threat Detection Tactic: Command and Control Data Source: Elastic Defend Data Source: Suricata Resources: Investigation Guide ·

Share on:

This detection correlates Suricata alerts with Elastic Defend network events to identify the source process performing the network activity.

Newly Observed High Severity Suricata Alert

Feb 23, 2026 · Use Case: Threat Detection Rule Type: Higher-Order Rule Resources: Investigation Guide Domain: Network Data Source: Suricata ·

Share on:

This rule detects Suricata high severity alerts that are observed for the first time in the previous 5 days of alert history. Analysts can use this to prioritize triage and response.