Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
7
5
3
3
2
Contributors
23
1
Categories
21
21
19
3
1
Platforms
23
9
Products / Services
5
4
2
2
2
MITRE Techniques
22
20
15
9
4
CVEs
71
71
64
58
49
24
Detects web service accounts (e.g., www-data) unexpectedly spawning shells from FFmpeg. This behavior is strongly indicative of remote code execution (RCE) via the PixelSmash vulnerability, specifically targeting automated preview generation in platforms like Nextcloud.
Detects instances where FFmpeg media processing tools spawn interactive shell processes. This behavior is highly indicative of successful remote code execution (RCE) via CVE-2026-8461 (PixelSmash), where an attacker hijacks the AVBuffer struct to call libc's system() function.
Detects instances where FFmpeg media processing tools spawn interactive shell processes. This behavior is highly indicative of successful remote code execution (RCE) via CVE-2026-8461 (PixelSmash), where an attacker hijacks the AVBuffer struct to call libc's system() function.
Page 2 of 2