Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
3
2
1
1
Contributors
6
1
Categories
7
3
2
2
2
Platforms
7
1
Products / Services
4
3
1
1
1
MITRE Techniques
6
3
2
2
2
CVEs
71
71
64
58
49
Detects the execution of an executable file that was immediately launched by 7-Zip (7z.exe or 7zG.exe) after processing a file, characteristic of a Mark-of-the-Web (MOTW) bypass exploit involving RAR5 archives. By extracting files from these archives, the 7-Zip process can inadvertently strip or prevent the assignment of the Zone.Identifier Alternate Data Stream, allowing the payload to bypass SmartScreen security prompts.
Detects OpenVPN Connect spawning unexpected child processes such as command interpreters or scripting engines, which indicates potential exploitation of the echo-script arbitrary code execution vulnerability (CVE-2026-45115). This vulnerability allows attackers to push a malicious echo directive via the VPN server configuration that forces the client to execute arbitrary commands upon disconnection.
This rule detects potentially malicious activity associated with the exploitation of CVE-2026-45115 in AnyDesk, including the creation of the 'adprinterpipe' named pipe, the spawning of suspicious elevated child processes (e.g., cmd.exe, powershell.exe) by AnyDesk processes, or the installation of services from an AnyDesk process context.
Detects potential exploitation of 7-Zip RAR5 vulnerabilities where the Mark-of-the-Web (MOTW) Zone.Identifier is not propagated during extraction, enabling files to execute without SmartScreen warnings. The rule monitors for the creation of executable file types in common user-writable directories by 7-Zip processes and the subsequent execution of files from those locations by explorer.exe.
This rule detects potential exploitation of the Ghidra vulnerability CVE-2026-45115, which allows arbitrary code execution during the loading of malicious project files or scripts. It monitors for suspicious child processes (e.g., cmd.exe, powershell.exe, bash) spawned by core Ghidra executables (ghidraRun, analyzeHeadless), which is characteristic of successful exploitation.
Detects indicators of compromise associated with CVE-2026-45115 in OpenVPN Connect, including suspicious child processes spawned by OpenVPN, the creation of known PoC marker files, and the execution of commands containing exploitation strings related to echo script injection.
Detects OpenVPN Connect spawning unexpected child processes such as command interpreters or malicious payloads. This behavior is indicative of exploitation of the 'echo script' arbitrary code execution vulnerability where a malicious VPN server pushes arbitrary commands to be executed upon client disconnection.
