Tag
rmcp Streamable HTTP Server Transport DNS Rebinding Vulnerability
2 rules 1 TTPThe `rmcp` crate before v1.4.0 is vulnerable to DNS rebinding attacks via the Streamable HTTP server transport due to missing Host header validation, potentially allowing arbitrary code execution on a victim's machine if they visit a malicious website.
WSO2 Products Vulnerable to XML External Entity (XXE) Injection via CVE-2024-2374
2 rules 2 TTPsCVE-2024-2374 describes an XML External Entity (XXE) vulnerability in multiple WSO2 products, where improperly configured XML parsers allow attackers to inject malicious XML payloads to include external resources, leading to confidential file access, limited HTTP resource access, and denial-of-service attacks.
Multiple Alerts in Same ATT&CK Tactic by Host
2 rules 4 TTPsThis rule correlates multiple security alerts associated with the same ATT&CK tactic on a single host within a defined time window, helping to identify hosts exhibiting concentrated malicious behavior indicative of an active intrusion or post-compromise activity, focusing on Credential Access, Defense Evasion, Execution, and Command and Control tactics.
Metasploit Exploitation via Malicious Confluence Plugin
2 rules 3 TTPsA Metasploit module exploits Atlassian Confluence servers by deploying a malicious Java plugin that downloads Meterpreter, granting the attacker full control over the compromised system.