Tag
FileBrowser Authentication Bypass via Forged Proxy Authentication Header
1 rule 3 TTPsAn unauthenticated attacker can impersonate any user, including administrators, or automatically create new user accounts in FileBrowser by forging the `X-Remote-User` HTTP header when the server is configured for proxy authentication and is directly reachable, leading to full administrative control and unauthorized access to data.
Ivanti VTM Administrator Account Creation via CVE-2024-7593
2 rules 2 TTPs 1 CVEUnauthenticated remote attackers are exploiting CVE-2024-7593 in Ivanti Virtual Traffic Manager (vTM) to bypass authentication and create new administrator accounts, potentially leading to full system compromise.
Windows User Account Creation via net.exe
3 rules 2 TTPsAttackers may create new accounts on Windows systems using `net.exe` to maintain access and establish persistence, which this detection identifies.
Cisco ASA - New Local User Account Creation
2 rules 2 TTPsDetection of new user account creations on Cisco ASA devices, potentially indicating unauthorized access or persistence attempts by adversaries.