Here's an example AnyConnect CVE, which started being yeeted this week (saml strings in GET request). 100% tagged as malicious in GreyNoise.