Data Source: Zeek

Abnormally Large DNS Response

Jun 8, 2026 · Use Case: Threat Detection Tactic: Lateral Movement Tactic: Impact Resources: Investigation Guide Use Case: Vulnerability Data Source: PAN-OS Data Source: Network Traffic Data Source: Zeek ·

Share on:

Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.

Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940)

Jun 8, 2026 · Domain: Network Domain: Application Domain: Web Use Case: Threat Detection Use Case: Vulnerability Tactic: Initial Access Data Source: Network Packet Capture Data Source: Network Traffic Data Source: Zeek Resources: Investigation Guide ·

Share on:

Identifies the network signature of CVE-2026-41940, a pre-auth root-level authentication bypass in cPanel and WebHost Manager (WHM) caused by a CRLF injection in the session writer. The exploit-inherent shape on the wire is a GET / request to a cPanel/WHM admin port (typically TCP/2087, 2086, 2083, 2082, 2095, 2096) carrying an Authorization: Basic header whose base64-decoded value contains CRLF-injected session fields, which causes cpsrvd to respond with a 3xx redirect whose Location header leaks a /cpsessNNNNNNNNNN token granting the attacker a privileged session. This is the network-layer equivalent of the cPanel access_log artifact identified by Unfold and watchTowr as the first bulletproof detection for this CVE: a GET / recorded with auth_method=b (HTTP Basic). Legitimate access to GET / on a WHM admin port returns 200 with the login screen and never includes HTTP Basic credentials, so this combination is not produced by normal use.

RDP (Remote Desktop Protocol) from the Internet

Jun 8, 2026 · Tactic: Command and Control Tactic: Lateral Movement Tactic: Initial Access Domain: Endpoint Use Case: Threat Detection Data Source: PAN-OS Data Source: Network Traffic Data Source: Zeek Resources: Investigation Guide ·

Share on:

This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.

RPC (Remote Procedure Call) from the Internet

Jun 8, 2026 · Tactic: Initial Access Domain: Endpoint Use Case: Threat Detection Data Source: Network Traffic Data Source: PAN-OS Data Source: Zeek Resources: Investigation Guide ·

Share on:

This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.

RPC (Remote Procedure Call) to the Internet

Jun 8, 2026 · Tactic: Initial Access Tactic: Lateral Movement Domain: Endpoint Use Case: Threat Detection Data Source: PAN-OS Data Source: Network Traffic Data Source: Zeek Resources: Investigation Guide ·

Share on:

This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.

SMB (Windows File Sharing) Activity to the Internet

Jun 8, 2026 · Tactic: Initial Access Tactic: Exfiltration Domain: Network Use Case: Threat Detection Data Source: PAN-OS Data Source: Network Traffic Data Source: Zeek Resources: Investigation Guide ·

Share on:

This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration.

SMTP on Port 26/TCP

Jun 8, 2026 · Tactic: Command and Control Tactic: Exfiltration Domain: Endpoint Use Case: Threat Detection Data Source: PAN-OS Data Source: Network Traffic Data Source: Zeek Resources: Investigation Guide ·

Share on:

This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems.