Process Creation with Exploit/Vulnerability Keywords

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects the creation of new processes where the command line contains keywords such as 'exploit' or 'vulnerability'. This could indicate an attempt to execute an exploit or leverage a known vulnerability, potentially as part of an attack.