Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
5
1
1
Contributors
4
3
Categories
7
3
3
2
1
Platforms
5
1
Products / Services
5
5
3
2
1
MITRE Techniques
7
3
3
2
1
CVEs
71
71
64
58
49
Detects Microsoft Exchange Control Panel (ECP) worker process (w3wp.exe) spawning suspicious child processes (e.g., cmd.exe, powershell.exe, mshta.exe) that are commonly associated with the exploitation of CVE-2020-0688. This vulnerability involves unsafe deserialization within the Exchange ECP ViewState handling, which allows an attacker to execute arbitrary code with SYSTEM privileges.
Detects Microsoft Exchange Control Panel (ECP) worker process (w3wp.exe) spawning suspicious child processes (e.g., cmd.exe, powershell.exe, mshta.exe) that are commonly associated with the exploitation of CVE-2020-0688. This vulnerability involves unsafe deserialization within the Exchange ECP ViewState handling, which allows an attacker to execute arbitrary code with SYSTEM privileges.
Detects the presence of known artifacts associated with the GhostContainer backdoor, including indicators of Neo-reGeorg web shell usage, ysoserial payloads, and exploitation attempts targeting the CVE-2020-0688 vulnerability via VIEWSTATE manipulation.
Detects potential exploitation attempts against Microsoft Exchange Server, specifically targeting the ECP (Exchange Control Panel) through VIEWSTATE parameter tampering related to CVE-2020-0688, and correlates this with suspicious behavior in the w3wp.exe process, such as unauthorized module loading (e.g., clr.dll, system.web.dll) and abnormal child process creation which may indicate the deployment of in-memory backdoors like GhostContainer.
Detects exploitation attempts of the Microsoft Exchange vulnerability CVE-2020-0688. This vulnerability allows for remote code execution due to improper validation of cmdlet arguments. The rule specifically looks for GET requests to '/ecp/' or '/owa/' paths containing '__VIEWSTATE=' in the query string, which is indicative of the exploitation attempt.
Detects exploitation attempts targeting CVE-2020-0688, a remote code execution vulnerability in Microsoft Exchange Server. The rule specifically looks for requests to '/ecp/default.aspx' containing '__VIEWSTATEGENERATOR=' and '__VIEWSTATE=' in the query string, which are indicators of the exploit.
Detects the exploitation of the Microsoft Exchange vulnerability CVE-2020-0688, which is a remote code execution vulnerability. The rule specifically looks for an 'Error' level EventID 4 from the 'MSExchange Control Panel' provider, combined with the presence of '__VIEWSTATE=' in the event data, indicating an attempt to exploit the vulnerability via the Eventlog.