Attack Detection

Attack Detection Team at @ptsecurity

[Attack Detection @AttackDetection]

🚨 First summer Suricata rules update is live: https://t.co/Bom73mlzFQ

• Stealers: SHub, Stealc, Majanito/WeedHack, VenomStealer, DarkCloud
• RATs: KongRAT, PoisonX/10FXRAT, BananaRAT/SmartRAT
• Botnet: RustoBot
• Loader: PowerLoader
#Suricata #Malware #CyberSecurity

[Attack Detection @AttackDetection]

🔥 Yep, the hot one in React!
We’ve added Suricata signatures for the CVSS 10.0 #React2Shell (#CVE-2025-55182) - a unauth RCE vulnerability in React Server Components
👉 Check it out at https://t.co/t6TMflynJX
Stay protected!
#suricata #ids #cybersecurity

[Attack Detection @AttackDetection]

🚨Suricata Rules Update - Android Threats🚨
New Android-focused network detection rules are now live on https://t.co/Bom73mlzFQ:
• SpyNote
• SuperCard X
• Konfety
• DCHSpy
• RedHook
• LunaSpy
• ClayRAT
• Brokewell
• some generics
#Suricata #AndroidMalware #CyberSecurity

[Attack Detection @AttackDetection]

🚨We have added a #Suricata signature for the recent #SharePoint RCE (#CVE-2025-53770, CVE-2025-49706) exploitation attributes to our open ruleset. It detects signs of successful machine key leakage.
🔗Check it out: https://t.co/hKVScOqG0n
#cybersecurity #ids

[Attack Detection @AttackDetection]

@grok is that great?

[Attack Detection @AttackDetection]

🚨We have added #suricata signature for the recent #Fortiweb (CVE-2025-25257) vulnerability in our open ruleset.

Check it out: 👉https://t.co/AEoLKzWj0f #cybersecurity #ids #fortinet

[Attack Detection @AttackDetection]

🚨We have added new #suricata signatures for the recent #CitrixBleed2 (CVE-2025-5777) vulnerability in our open ruleset. Not only for an attempt, but for detection of a successful exploitation as well

Check it out:
👉https://t.co/gf4sr9bOyp

#cybersecurity #ids #citrix

[Attack Detection @AttackDetection]

🚨 Malware Suricata Rules Update Available on https://t.co/Bom73mm7vo! 🚨

🛑 Remcos, XWorm RAT
🛑 Stealc v2 Stealer
🛑 Filsh Backdoor
🛑 Andromeda Botnet
🛑 PhantomEnigma Banker (see TI Report https://t.co/ciEKVmPrOH)

#Suricata

[Attack Detection @AttackDetection]

🚨 We've added a new signature to our Suricata ruleset for the critical vulnerability CVE-2025-49113 in Roundcube, previously reproduced by @ptswarm.
This RCE vulnerability potentially exposes millions of hosts worldwide.
Update your rules now: https://t.co/Bom73mlzFQ
#Suricata

[Attack Detection @AttackDetection]

🐍 Suricata rules update !
We’ve added detections for newly disclosed RCE vulns:
- Apache Tomcat (CVE-2025-24813)
- Ingress NGINX (CVE-2025-1974)
🆕 Detects for tunnel services (tunnelto, Telebit, Pinggy), Rclone and AdaptixC2 activity.

See full list → https://t.co/Bom73mlzFQ

[Attack Detection @AttackDetection]

We're dropping a massive malware signature update
🎭 Highlights: RustyNet loader, WorldWind stealer, Slam RAT, nasty XWorm, SpyNote, Hydra, Zanubis ...and plenty more!
🔗 https://t.co/Bom73mm7vo

[Attack Detection @AttackDetection]

Guess who's back? 🎉 Our Suricata ruleset has found a new home at https://t.co/Bom73mlzFQ! Enable source ptrules/open in Suricata-Update to stay ahead of threats.

[Attack Detection @AttackDetection]

@Xqy1005 @missdiog Hi, due to unknown reason our repo was blocked and then unblocked🤨

[Attack Detection @AttackDetection]

Spring Core RCE 0day aka Spring4Shell came out recently. Detect exploitation attempts with our #suricata rule: https://t.co/yC5IVDmp98

[Attack Detection @AttackDetection]

One can get #Zabbix panel admin rights in one request with CVE-2022-23131. But you can detect it easily with our #suricata rule. We worked on possible rule bypasses and false positive rate
https://t.co/BPxd5jYxfM

[Attack Detection @AttackDetection]

Rule updates: our #suricata rules detect all known Log4Shell CVE-2021-44228 bypasses for now. Also added a rule to detect a successful log4j exploitation!

[Attack Detection @AttackDetection]

Breaking news, the internet is under fire again! Releasing #suricata detection rule for log4j aka Log4Shell and CVE-2021-44228 as soon as possible. We will update the rule along with the new exploits and bypasses found.
https://t.co/ZiS41upfzh

[Attack Detection @AttackDetection]

@leonjza Great, also /cgi-bin/ is not the only exploitation path😉
@leonjza thanks, we've updated the rule and added one more for the RCE case. Apatch!

[Attack Detection @AttackDetection]

Good: Use our #suricata rules to detect malicious attempts of the new CVE-2021-41773 #Apache HTTP Server dir traversal.
Better: Patch your apache
The best: Do both!
https://t.co/aeYmm9QvPJ

[PT SWARM @ptswarm]

🔥 We have reproduced the fresh CVE-2021-41773 Path Traversal vulnerability in Apache 2.4.49.

If files outside of the document root are not protected by "require all denied" these requests can succeed.

Patch ASAP!

https://t.co/6JrbayDbqG

[Attack Detection @AttackDetection]

How to get a system shell on any windows version? Use #SystemNightmare exploit.
How to detect SystemNightmare usage in a network? Use our rules!
Oh, here they are: https://t.co/a9QzsZzG8o