GitHub Repo

Web Detections

Name Data Source Technique Type Analytic Story Date
Plain HTTP POST Exfiltrated Data Splunk Stream HTTP T1048.003 TTP Command And Control, Data Exfiltration, APT37 Rustonotto and FadeStealer 2026-09-08
Zscaler Phishing Activity Threat Blocked T1566 Anomaly Hellcat Ransomware, Zscaler Browser Proxy Threats 2026-05-13
Zscaler Exploit Threat Blocked T1566 TTP Zscaler Browser Proxy Threats 2026-05-13
Nginx ConnectWise ScreenConnect Authentication Bypass Nginx Access T1190 TTP Seashell Blizzard, Scattered Lapsus$ Hunters, ConnectWise ScreenConnect Vulnerabilities, Hellcat Ransomware 2026-09-08
Zscaler Behavior Analysis Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
HTTP Duplicated Header Suricata T1071.001 T1190 Anomaly HTTP Request Smuggling 2026-05-13
Web JSP Request via URL Nginx Access T1133 T1190 T1505.003 TTP Spring4Shell CVE-2022-22965, Earth Alux 2026-05-13
Zscaler Privacy Risk Destinations Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Zscaler CryptoMiner Downloaded Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Zscaler Legal Liability Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Zscaler Scam Destinations Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Unusual HTTP Request Method Zeek HTTP T1071.001 T1190 Anomaly Command And Control, HTTP Request Smuggling 2026-10-12
Web Remote ShellServlet Access Nginx Access T1190 TTP CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server, GhostRedirector IIS Module and Rungan Backdoor 2026-05-13
Confluence Data Center and Server Privilege Escalation Nginx Access T1190 TTP Confluence Data Center and Confluence Server Vulnerabilities, CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server 2026-05-13
Zscaler Virus Download threat blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Spring4Shell Payload URL Request Nginx Access T1133 T1190 T1505.003 TTP Spring4Shell CVE-2022-22965 2026-05-13
Web Spring Cloud Function FunctionRouter Splunk Stream HTTP T1133 T1190 TTP Spring4Shell CVE-2022-22965 2026-05-13
HTTP Rapid POST with Mixed Status Codes Nginx Access T1071.001 T1190 T1595 Anomaly HTTP Request Smuggling 2026-05-13
Zscaler Potentially Abused File Download T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Zscaler Malware Activity Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Tomcat Session Deserialization Attempt Nginx Access T1190 T1505.003 Anomaly Apache Tomcat Session Deserialization Attacks 2026-05-13
HTTP Possible Request Smuggling Suricata T1071.001 TTP HTTP Request Smuggling 2026-05-13
Tomcat Session File Upload Attempt Nginx Access T1190 T1505.003 Anomaly Apache Tomcat Session Deserialization Attacks 2026-05-13
Log4Shell JNDI Payload Injection Attempt Nginx Access T1133 T1190 Anomaly CISA AA22-257A, Log4Shell CVE-2021-44228, CISA AA22-320A 2026-09-08
Jenkins Arbitrary File Read CVE-2024-23897 Nginx Access T1190 TTP Hellcat Ransomware, Jenkins Server Vulnerabilities 2026-05-13
Multiple Archive Files Http Post Traffic Splunk Stream HTTP T1048.003 TTP Hellcat Ransomware, Command And Control, Data Exfiltration, APT37 Rustonotto and FadeStealer 2026-05-13
Hunting for Log4Shell Nginx Access T1133 T1190 Hunting Log4Shell CVE-2021-44228, CISA AA22-320A 2026-05-13
Zscaler Adware Activities Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Zscaler Employment Search Web Activity T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Web Spring4Shell HTTP Request Class Module Splunk Stream HTTP T1133 T1190 TTP Spring4Shell CVE-2022-22965 2026-05-13
Gsuite Email With Known Abuse Web Service Link G Suite Gmail T1566.001 Anomaly Dev Sec Ops 2026-05-13
Cisco NVM - Suspicious Download From File Sharing Website Cisco Network Visibility Module Flow Data T1197 Anomaly APT37 Rustonotto and FadeStealer, BlankGrabber Stealer, Cisco Network Visibility Module Analytics 2026-09-22
Cisco NVM - Webserver Download From File Sharing Website Cisco Network Visibility Module Flow Data T1105 T1190 TTP GhostRedirector IIS Module and Rungan Backdoor, Cisco Network Visibility Module Analytics 2026-09-22
Cisco Secure Firewall - Privileged Command Execution via HTTP Cisco Secure Firewall Threat Defense Intrusion Event T1059 T1505.003 Anomaly Salt Typhoon, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco SA - Automated Web Reconnaissance via HTTP Access Errors Cisco Secure Access Proxy T1595 Anomaly Cisco Secure Access Analytics 2026-06-09
HTTP POST Request with Encoded Payload Zeek HTTP T1071.001 T1132.001 Anomaly Command And Control, Data Exfiltration 2026-10-19
Cisco IOS XE WebUI Login From IOSd Local Port Cisco IOS Logs T1078 T1190 TTP Salt Typhoon 2026-05-19
Cisco IOS XE WebUI Programmatic Configuration Cisco IOS Logs T1078 T1190 Anomaly Salt Typhoon 2026-09-08
Supernova Webshell T1133 T1505.003 TTP GhostRedirector IIS Module and Rungan Backdoor, NOBELIUM Group, Earth Alux 2026-05-13
High Volume of Bytes Out to Url Nginx Access T1567 Anomaly Data Exfiltration, Hellcat Ransomware 2026-05-13
Exploit Public Facing Application via Apache Commons Text Nginx Access T1133 T1190 T1505.003 Anomaly Text4Shell CVE-2022-42889 2026-05-13
HTTP Scripting Tool User Agent Nginx Access T1071.001 Anomaly HTTP Request Smuggling, Suspicious User Agents 2026-09-22
PaperCut NG Remote Web Access Attempt Suricata T1133 T1190 TTP PaperCut MF NG Vulnerability 2026-05-13
HTTP Request to Reserved Name on IIS Server Suricata T1071.001 T1190 TTP HTTP Request Smuggling 2026-05-13
WordPress Bricks Builder plugin RCE Nginx Access T1190 TTP WordPress Vulnerabilities, Hellcat Ransomware 2026-05-13
Java Class File download by Java User Agent Splunk Stream HTTP T1190 TTP Log4Shell CVE-2021-44228 2026-05-13
HTTP Malware User Agent Suricata T1071.001 TTP Meduza Stealer, RedLine Stealer, Lokibot, Crypto Stealer, Lumma Stealer, Suspicious User Agents 2026-09-22
Cisco Privileged Account Creation with HTTP Command Execution T1021.004 T1078 T1136 Correlation Salt Typhoon, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
HTTP RMM User Agent Suricata T1071.001 T1219 Anomaly Remote Monitoring and Management Software, Suspicious User Agents 2026-09-22
HTTP PUA User Agent Suricata T1071.001 Anomaly Local Privilege Escalation With KrbRelayUp, BlackSuit Ransomware, Cactus Ransomware, Suspicious User Agents 2026-09-22
HTTP C2 Framework User Agent Suricata T1071.001 TTP Malicious PowerShell, BishopFox Sliver Adversary Emulation Framework, Spearphishing Attachments, Meterpreter, Cobalt Strike, Brute Ratel C4, Suspicious User Agents, Tuoni 2026-09-22
Monitor Web Traffic For Brand Abuse N/A TTP Brand Monitoring 2026-05-13