Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
8
7
4
3
3
Contributors
27
4
Categories
26
25
17
8
7
Platforms
28
20
4
1
1
Products / Services
8
7
7
7
6
MITRE Techniques
21
13
10
10
9
CVEs
68
68
63
58
50
31
Detects rapid enumeration of system binaries related to SSH and networking libraries (libssh2, libcurl, libgit) or version checks within a 5-minute window, which may indicate reconnaissance or pre-exploitation activity related to vulnerabilities like CVE-2026-55200.
Detects the execution or presence of identified exploit harness binaries and scripts associated with CVE-2026-55200, an RCE vulnerability in libssh2. The rule monitors process launches for specific filenames and command-line arguments indicative of proof-of-concept or exploitation tooling from the 'exploitarium' repository.
Detects reconnaissance activities targeting binaries or modules containing libssh2 library references or specific PHP symbol offsets (e.g., zend_execute_internal, zif_system). This rule monitors for common administrative and debugging tools like ldd, strings, readelf, and nm being used to scan files for sensitive symbols or version information, as well as specific PHP enumeration patterns and validation script executions, which are commonly associated with the triage process for CVE-2026-55200.
Detects outbound SSH connections from common applications using libssh2 to external, non-standard or untrusted servers, followed by an anomalously large inbound TCP data transfer before authentication completes. This behavior is indicative of exploitation attempts targeting CVE-2026-55200, where a malicious SSH server triggers a heap overflow in the client via a malformed packet.
Detects indicators of exploitation attempts for the libssh2 pre-auth heap RCE vulnerability (CVE-2026-55200). The rule monitors for the execution of known harness binaries, abnormal child processes spawned by sshd, unauthorized file creation in sensitive temporary directories, and the loading of libssh2 libraries from non-standard, writable locations.
Detects the execution of known CVE-2026-55200 exploit harness and server binaries, or the creation of the libpwn_rce_proof.txt artifact. These activities indicate active exploitation staging or the successful execution of an out-of-bounds heap write exploit chain against libssh2.
This rule detects the execution of known exploit binaries and proof-of-concept (PoC) tools associated with vulnerabilities in libssh2, as well as anomalous child process spawning from common SSH-related applications (curl, git, php). These behaviors are indicative of exploitation attempts or unauthorized activity related to the libssh2 exploit chain.
This rule detects the creation, execution, or presence of specific file names and command-line arguments associated with local RCE research, proof-of-concept exploits, and server-side harnesses, specifically identifying artifacts prefixed with 'libpwn_'.
This rule monitors for file creations and process executions associated with known proof-of-concept (PoC) artifacts for CVE-2026-55200 (a pre-authentication remote code execution vulnerability in libssh2). It also identifies suspicious child processes spawned from common SSH-related binaries, which may indicate successful exploitation or the execution of malicious payloads.
This rule monitors for the presence of known exploit harness binaries associated with CVE-2026-55200 on disk or in command lines, and identifies post-exploitation activity where common network utilities (curl, git, php) execute unsigned or suspicious child processes, which often indicates lateral movement or payload staging.
Page 2 of 2