Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
7
5
3
3
2
Contributors
23
1
Categories
21
21
19
3
1
Platforms
23
9
Products / Services
5
4
2
2
2
MITRE Techniques
22
20
15
9
4
CVEs
71
71
64
58
49
24
Detects anomalous outbound network connections initiated by media server processes (Jellyfin, FFmpeg, or Nextcloud) immediately following an inbound video file upload (AVI) to the media server's API, indicative of post-exploitation activity related to the PixelSmash (CVE-2026-8461) heap out-of-bounds write vulnerability.
Detects potential remote code execution (RCE) attempts leveraging a vulnerability in the Nextcloud Movie preview provider (CVE-2026-8461). The detection identifies cases where the web server service user (www-data) unexpectedly spawns ffmpeg or ffprobe, followed by the immediate spawning of a command shell from these multimedia processing binaries, which is highly anomalous.
Detects the spawning of /bin/sh or /bin/bash as a direct child process of ffmpeg, jellyfin, or nextcloud. This behavior is often indicative of exploitation attempts against these media and storage services, potentially leveraging remote code execution vulnerabilities.
Jellyfin Ffprobe Exploit
YARA-L
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Detects the spawning of shell processes (sh, bash, dash, zsh, ksh) as children of ffmpeg, ffprobe, jellyfin-ffmpeg, or emby-ffmpeg. This behavior is indicative of a successful AVBuffer.free pointer hijack vulnerability (CVE-2026-8461, also known as PixelSmash) being exploited to achieve arbitrary command execution. The rule specifically looks for these parent processes spawning shell children, or if the child process command line contains common shell paths or network-related commands, and filters for specific user accounts often associated with media servers or generic system accounts.
Detects potential exploitation of CVE-2026-8461 (PixelSmash) where an attacker hijacks the AVBuffer.free function pointer in media processing software (ffmpeg, ffprobe, etc.) to trigger arbitrary code execution via a spawned shell process.
Detects the execution of ffmpeg with the '-decoders' flag to enumerate available decoders, specifically looking for the vulnerable MagicYUV decoder. It also identifies 'grep' commands searching for 'magicyuv' in process command lines, which could indicate reconnaissance or triage activity related to CVE-2026-8461.
Detects web service accounts (e.g., www-data) unexpectedly spawning shells from FFmpeg. This behavior is strongly indicative of remote code execution (RCE) via the PixelSmash vulnerability, specifically targeting automated preview generation in platforms like Nextcloud.
Detects web service accounts (e.g., www-data) unexpectedly spawning shells from FFmpeg. This behavior is strongly indicative of remote code execution (RCE) via the PixelSmash vulnerability, specifically targeting automated preview generation in platforms like Nextcloud.
Detects web service accounts (e.g., www-data) unexpectedly spawning shells from FFmpeg. This behavior is strongly indicative of remote code execution (RCE) via the PixelSmash vulnerability, specifically targeting automated preview generation in platforms like Nextcloud.
Detects instances where FFmpeg media processing tools spawn interactive shell processes. This behavior is highly indicative of successful remote code execution (RCE) via CVE-2026-8461 (PixelSmash), where an attacker hijacks the AVBuffer struct to call libc's system() function.
Detects web service accounts (e.g., www-data) unexpectedly spawning shells or scripting interpreters from FFmpeg. This behavior is strongly indicative of remote code execution (RCE) via the PixelSmash vulnerability, specifically targeting automated preview generation in platforms like Nextcloud.
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Detects instances where FFmpeg media processing tools (ffmpeg, ffprobe, ffmpegthumbnailer) spawn interactive shell processes (bash, sh, dash, zsh, cmd.exe, powershell.exe, pwsh.exe). This behavior is highly indicative of successful remote code execution (RCE) via CVE-2026-8461 (PixelSmash), where an attacker hijacks the AVBuffer struct to call libc's system() function.
Detects unexpected shell or script interpreter processes (e.g., sh, bash, python, perl, nc, curl, wget) spawned as children of media processing applications like ffmpeg or ffprobe, especially when running under service accounts associated with Jellyfin, Nextcloud, or Emby. This behavior could indicate exploitation of a vulnerability (e.g., CVE-2026-8461 / PixelSmash) allowing arbitrary command execution.
Detects web service accounts (e.g., www-data) unexpectedly spawning shells from FFmpeg. This behavior is strongly indicative of remote code execution (RCE) via the PixelSmash vulnerability, specifically targeting automated preview generation in platforms like Nextcloud.
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Detects instances where FFmpeg media processing tools spawn interactive shell processes. This behavior is highly indicative of successful remote code execution (RCE) via CVE-2026-8461 (PixelSmash), where an attacker hijacks the AVBuffer struct to call libc's system() function.
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Detects unexpected shell or suspicious utility execution as a child process of media processing or machine learning pipeline services (e.g., ffmpeg, ffprobe, Jellyfin, Nextcloud, Immich, PhotoPrism, vLLM). This behavior can indicate exploitation of vulnerabilities like CVE-2026-8461 (PixelSmash) or other forms of arbitrary code execution, especially when combined with reverse shell indicators or execution by service accounts.
Page 1 of 2