Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
5
2
Contributors
3
2
1
1
Categories
4
3
3
2
1
Platforms
7
2
Products / Services
4
1
MITRE Techniques
4
4
3
3
2
CVEs
71
71
64
58
49
Detects a cmd.exe one-liner that downloads a VBS file with curl into TEMP, runs it with cscript, and deletes it, matching the CVE-2026-24423 CommandMount payload. The strict regex on the full chain keeps false positives low.
Detects the SmarterMail service process spawning cmd.exe /c or bash/sh -c, consistent with command injection via the unauthenticated connect-to-hub API (CVE-2026-24423). Parent match is limited to MailService or SmarterMail install paths to reduce noise.
Detects the SmarterMail service process spawning cmd.exe /c or bash/sh -c, consistent with command injection via the unauthenticated connect-to-hub API (CVE-2026-24423). Parent match is limited to MailService or SmarterMail install paths to reduce noise.
Detects the creation of web shells (.aspx, .ashx) in the SmarterMail web root directory by the mail service process. This is a common persistence mechanism used by attackers after exploiting vulnerabilities like CVE-2026-24423 to maintain remote access.
Detects the creation of web shells (.aspx, .ashx) in the SmarterMail web root directory by the mail service process. This is a common persistence mechanism used by attackers after exploiting vulnerabilities like CVE-2026-24423 to maintain remote access.
Detects the creation of web shells (.aspx, .ashx) in the SmarterMail web root directory by the mail service process. This is a common persistence mechanism used by attackers after exploiting vulnerabilities like CVE-2026-24423 to maintain remote access.
Detects the creation of web shells (.aspx, .ashx) in the SmarterMail web root directory by the mail service process. This is a common persistence mechanism used by attackers after exploiting vulnerabilities like CVE-2026-24423 to maintain remote access.
