Contact from a source probing a specific CVE
Surfaces hosts that were contacted by an IP HoneyLabs observed probing a specific CVE exploit path, and lists the CVEs that source went after. Available on paid HoneyLabs plans, where the attacker collection also…
Description
Surfaces hosts that were contacted by an IP HoneyLabs observed probing a specific CVE exploit path, and lists the CVEs that source went after. Available on paid HoneyLabs plans, where the attacker collection also carries CVE probers. This is the query to run when you want to know whether the vulnerabilities being probed in the wild right now line up with what you actually expose: cross-reference the CVE column against your own asset inventory and patch state.
Detection logic
Detection requirements
- Platform
- ContainersESXiIaaSLinuxmacOSNetwork DevicesPREWindows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
- Log source product
- threatintelligencetaxii
- Log source service
- threatintelligenceindicator
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 6a2f9b58-c31d-4e07-9d84-3f5b1c7e2a90
- Tagged by the source as
- InitialAccessReconnaissance
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1