Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
8
7
4
3
3
Contributors
27
4
Categories
26
25
17
8
7
Platforms
28
20
4
1
1
Products / Services
8
7
7
7
6
MITRE Techniques
21
13
10
10
9
CVEs
68
68
63
58
50
31
Detects potential remote code execution (RCE) via CVE-2026-55200 in libssh2-linked applications. The rule monitors for two signals: firstly, a post-exploitation child process (such as a shell or interpreter) spawned by a common libssh2-reliant application (e.g., ssh, curl, git, php) shortly after an outbound connection to TCP ports 22 or 2222; secondly, anomalous outbound network connections to port 2222 originating from these same libssh2-linked binaries.
Detects the presence and execution of components associated with the 'Exploitarium' toolkit, a collection of exploit harnesses and proofs-of-concept. The rule monitors for process execution of specific filenames, file creation events, persistence via registry-based service installation, and image loads related to the toolkit's binaries.
This rule detects the presence and execution of files and scripts associated with the exploitation of CVE-2026-55200, such as harness binaries and proof-of-concept scripts. Additionally, it identifies post-exploitation behavior where common network-related processes (like curl, git, or sshd) spawn suspicious or unexpected child processes, which may indicate successful code execution or lateral movement originating from the compromised service.
Detects indicators of exploitation attempts against the CVE-2026-55200 libssh2 heap out-of-bounds write vulnerability. The rule identifies the creation of known PoC artifacts on disk, execution of exploit harnesses or probe binaries, Python scripts masquerading as or interacting with the PoC server, and libssh2-dependent client applications making network connections to the non-standard port 2222 used by the exploit scaffold.
Detects the execution of known exploit harnesses and proof-of-concept scripts related to CVE-2026-55200, a critical pre-authentication heap out-of-bounds write vulnerability in libssh2. The rule monitors for the execution of binaries and Python scripts identified as part of the libpwn exploit toolkit used to trigger the vulnerability.
Detects unauthenticated HTTP requests to sensitive Gitea endpoints containing the 'X-WEBAUTH-USER' header set to 'admin'. This rule identifies exploitation attempts against misconfigured Docker deployments where 'REVERSE_PROXY_TRUSTED_PROXIES' is improperly set to a wildcard, allowing unauthorized users to impersonate administrative accounts (CVE-2026-20896).
Detects the presence, file creation, or execution of known proof-of-concept (PoC) scripts, binaries, and directories associated with the exploitation of the libssh2 CVE-2026-55200 vulnerability.
Detects evidence of exploitation attempts related to the hypothetical CVE-2026-55200 vulnerability. The rule monitors for known exploit file names, command-line arguments, and specific network patterns targeting SSH ports (22, 2222) that indicate potential LibSSH2 exploitation.
This rule detects the presence of files and processes associated with the 'Exploitarium' proof-of-concept (PoC) toolset. It monitors for specific filenames, process names, and path patterns linked to known harnesses, exploit scripts, and malware families commonly associated with the repository.
Detects artifacts, execution patterns, and post-exploitation behaviors associated with the exploitation of the libssh2 heap out-of-bounds write vulnerability (CVE-2026-55200). The rule monitors for the presence of known proof-of-concept files, malicious SSH server orchestration via Python, outbound network traffic to the PoC's default non-standard port (2222) from SSH-capable applications, and post-exploitation shell or calculator spawns.
This rule monitors for file system activity associated with the 'libpwn' exploit suite, specifically targeting files related to the exploitation of CVE-2026-55200. It flags the presence of exploit harnesses, probes, and proofs of concept (PoCs) identified by specific filenames and directory structures.
Detects the presence of known exploit harness files or the execution of Python scripts and binaries associated with libssh2 publickey subsystem heap overflow and arbitrary free exploits (including proof-of-concept code and reproduction harnesses).
Detects outbound SSH connections to TCP port 2222 that exhibit specific cipher negotiation patterns (curve25519-sha256 and chacha20-poly1305@openssh.com) associated with a known malicious SSH server exploit scaffold for CVE-2026-55200. This vulnerability involves a pre-authentication heap out-of-bounds write in libssh2 clients.
Detects artifacts and activity related to the exploitation of CVE-2026-55200 in libssh2. The rule monitors for the creation or execution of identified libpwn exploit harness files and scripts, as well as suspicious network activity involving TCP port 2222, which is the default port for the PoC rogue SSH server. It also correlates the appearance of these exploit files with subsequent outbound SSH connections.
This rule detects the presence and execution of files associated with the proof-of-concept (PoC) exploit for CVE-2026-55200, a remote code execution vulnerability in libssh2. The rule monitors for specific exploit binary names and directory structures commonly used by security researchers or attackers to test or exploit this vulnerability.
Detects post-exploitation activity related to CVE-2026-55200 (libssh2 heap OOB write), specifically identifying when curl, git, or php processes spawn interactive shells or attempt to access sensitive processes like lsass.exe, indicating a successful exploit chain.
Detects reconnaissance and post-exploitation activity associated with the exploitation of the libssh2 CVE-2026-55200 vulnerability. The rule identifies the execution of known libpwn PoC binaries, libssh2-dependent client applications (curl, git, php) spawning unexpected shell processes, and unauthorized access to SSH-related configuration or key files by non-interactive processes.
Detects artifacts, execution of harness tooling, and post-exploitation behavior associated with CVE-2026-55200 in libssh2. The rule monitors for the presence of known exploit filenames (libpwn), suspicious Python script execution, unexpected shell spawning from SSH-enabled clients, and outbound network connections to non-standard ports typical of exploit scaffolding.
Detects the creation of files with specific names associated with Proof of Concept (PoC) code, remote code execution (RCE) harnesses, or exploit probes for CVE-2026-55200. This pattern indicates the presence of offensive security tooling or attempted exploitation of a specific software vulnerability on the host.
Detects the presence of malicious artifacts associated with the RoguePlanet campaign by ShinyHunters and Chaotic Eclipse, including specific malware families (BlueHammer, RedSun, UnDefend, Bluekit) and libpwn exploit harness components related to CVE-2026-55200.
Detects the execution of the libpwn_cve_2026_55200_server.py Python script, which is identified as a malicious SSH scaffold targeting CVE-2026-55200. This script facilitates exploitation of libssh2 clients by binding to a specific port and delivering malformed packets during the pre-authentication phase.
Page 1 of 2