GitHub Repo

Web Detections

Name Data Source Technique Type Analytic Story Date
Plain HTTP POST Exfiltrated Data Splunk Stream HTTP T1048.003 TTP APT37 Rustonotto and FadeStealer, Command And Control, Data Exfiltration 2026-09-08
Zscaler Phishing Activity Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats, Hellcat Ransomware 2026-05-13
Zscaler Exploit Threat Blocked T1566 TTP Zscaler Browser Proxy Threats 2026-05-13
Nginx ConnectWise ScreenConnect Authentication Bypass Nginx Access T1190 TTP ConnectWise ScreenConnect Vulnerabilities, Scattered Lapsus$ Hunters, Hellcat Ransomware, Seashell Blizzard 2026-09-08
Zscaler Behavior Analysis Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
HTTP Duplicated Header Suricata T1071.001 T1190 Anomaly HTTP Request Smuggling 2026-05-13
Web JSP Request via URL Nginx Access T1133 T1190 T1505.003 TTP Spring4Shell CVE-2022-22965, Earth Alux 2026-05-13
Zscaler Privacy Risk Destinations Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Zscaler CryptoMiner Downloaded Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Zscaler Legal Liability Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Zscaler Scam Destinations Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Web Remote ShellServlet Access Nginx Access T1190 TTP CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server, GhostRedirector IIS Module and Rungan Backdoor 2026-05-13
Confluence Data Center and Server Privilege Escalation Nginx Access T1190 TTP CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server, Confluence Data Center and Confluence Server Vulnerabilities 2026-05-13
Zscaler Virus Download threat blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Spring4Shell Payload URL Request Nginx Access T1133 T1190 T1505.003 TTP Spring4Shell CVE-2022-22965 2026-05-13
Web Spring Cloud Function FunctionRouter Splunk Stream HTTP T1133 T1190 TTP Spring4Shell CVE-2022-22965 2026-05-13
HTTP Rapid POST with Mixed Status Codes Nginx Access T1071.001 T1190 T1595 Anomaly HTTP Request Smuggling 2026-05-13
Zscaler Potentially Abused File Download T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Zscaler Malware Activity Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Tomcat Session Deserialization Attempt Nginx Access T1190 T1505.003 Anomaly Apache Tomcat Session Deserialization Attacks 2026-05-13
HTTP Possible Request Smuggling Suricata T1071.001 TTP HTTP Request Smuggling 2026-05-13
Tomcat Session File Upload Attempt Nginx Access T1190 T1505.003 Anomaly Apache Tomcat Session Deserialization Attacks 2026-05-13
Log4Shell JNDI Payload Injection Attempt Nginx Access T1133 T1190 Anomaly CISA AA22-320A, Log4Shell CVE-2021-44228, CISA AA22-257A 2026-09-08
Jenkins Arbitrary File Read CVE-2024-23897 Nginx Access T1190 TTP Jenkins Server Vulnerabilities, Hellcat Ransomware 2026-05-13
Multiple Archive Files Http Post Traffic Splunk Stream HTTP T1048.003 TTP APT37 Rustonotto and FadeStealer, Command And Control, Hellcat Ransomware, Data Exfiltration 2026-05-13
Hunting for Log4Shell Nginx Access T1133 T1190 Hunting CISA AA22-320A, Log4Shell CVE-2021-44228 2026-05-13
Zscaler Adware Activities Threat Blocked T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Zscaler Employment Search Web Activity T1566 Anomaly Zscaler Browser Proxy Threats 2026-05-13
Web Spring4Shell HTTP Request Class Module Splunk Stream HTTP T1133 T1190 TTP Spring4Shell CVE-2022-22965 2026-05-13
Gsuite Email With Known Abuse Web Service Link G Suite Gmail T1566.001 Anomaly Dev Sec Ops 2026-05-13
Cisco NVM - Suspicious Download From File Sharing Website Cisco Network Visibility Module Flow Data T1197 Anomaly APT37 Rustonotto and FadeStealer, BlankGrabber Stealer, Cisco Network Visibility Module Analytics 2026-09-22
Cisco NVM - Webserver Download From File Sharing Website Cisco Network Visibility Module Flow Data T1105 T1190 TTP GhostRedirector IIS Module and Rungan Backdoor, Cisco Network Visibility Module Analytics 2026-09-22
Cisco Secure Firewall - Privileged Command Execution via HTTP Cisco Secure Firewall Threat Defense Intrusion Event T1059 T1505.003 Anomaly Cisco Secure Firewall Threat Defense Analytics, Salt Typhoon 2026-05-13
Cisco SA - Automated Web Reconnaissance via HTTP Access Errors Cisco Secure Access Proxy T1595 Anomaly Cisco Secure Access Analytics 2026-06-09
Cisco IOS XE WebUI Login From IOSd Local Port Cisco IOS Logs T1078 T1190 TTP Salt Typhoon 2026-05-19
Cisco IOS XE WebUI Programmatic Configuration Cisco IOS Logs T1078 T1190 Anomaly Salt Typhoon 2026-09-08
Supernova Webshell T1133 T1505.003 TTP Earth Alux, NOBELIUM Group, GhostRedirector IIS Module and Rungan Backdoor 2026-05-13
High Volume of Bytes Out to Url Nginx Access T1567 Anomaly Hellcat Ransomware, Data Exfiltration 2026-05-13
Exploit Public Facing Application via Apache Commons Text Nginx Access T1133 T1190 T1505.003 Anomaly Text4Shell CVE-2022-42889 2026-05-13
HTTP Scripting Tool User Agent Nginx Access T1071.001 Anomaly HTTP Request Smuggling, Suspicious User Agents 2026-09-22
PaperCut NG Remote Web Access Attempt Suricata T1133 T1190 TTP PaperCut MF NG Vulnerability 2026-05-13
HTTP Request to Reserved Name on IIS Server Suricata T1071.001 T1190 TTP HTTP Request Smuggling 2026-05-13
WordPress Bricks Builder plugin RCE Nginx Access T1190 TTP WordPress Vulnerabilities, Hellcat Ransomware 2026-05-13
Java Class File download by Java User Agent Splunk Stream HTTP T1190 TTP Log4Shell CVE-2021-44228 2026-05-13
HTTP Malware User Agent Suricata T1071.001 TTP Suspicious User Agents, RedLine Stealer, Lumma Stealer, Meduza Stealer, Lokibot, Crypto Stealer 2026-09-22
Cisco Privileged Account Creation with HTTP Command Execution T1021.004 T1078 T1136 Correlation Cisco Secure Firewall Threat Defense Analytics, Salt Typhoon 2026-05-13
HTTP RMM User Agent Suricata T1071.001 T1219 Anomaly Remote Monitoring and Management Software, Suspicious User Agents 2026-09-22
HTTP PUA User Agent Suricata T1071.001 Anomaly Cactus Ransomware, BlackSuit Ransomware, Suspicious User Agents, Local Privilege Escalation With KrbRelayUp 2026-09-22
HTTP C2 Framework User Agent Suricata T1071.001 TTP Tuoni, Meterpreter, Brute Ratel C4, Suspicious User Agents, Malicious PowerShell, BishopFox Sliver Adversary Emulation Framework, Spearphishing Attachments, Cobalt Strike 2026-09-22
Monitor Web Traffic For Brand Abuse N/A TTP Brand Monitoring 2026-05-13