Lennin Cardozo
@Fozz230 followers5 downloads108 copies3 likes170 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
1
1
Platforms
1
1
Products / Services
1
Node.js / Bun runtimes seen and evaluates their version regarding the new (CVE-2026-111497), if patch is needed.
Detects execution of various PHP interpreter binaries and evaluates their version regarding the new (CVE-2026-109618 / CVE-2026-109619) if upgraded or fix is needed.
Finds Domain Controllers where the VMware NSX Guest Introspection drivers are loaded: vsepflt.sys (file introspection), vnetflt.sys / vnetWFP.sys (network introspection). The network drivers hook the Windows Filtering Platform (WFP), as the Falcon sensor does; on DCs this can add latency and reduce traffic analysis visibility. Shows sensor-online ("reboot") times next to NSX driver load times for each DC.
Data: AgentOnline + DriverLoad events, aid_master_main.csv lookup (ProductType 2 = DC)
Notes: - Both events fire mainly at boot / sensor start, so use a time range that covers
at least one patch cycle (e.g. 30 days).
- AgentOnline can fire more than once per boot, so one reboot may show several times.
Data: AgentOnline + DriverLoad events, aid_master_main.csv lookup (ProductType 2 = DC)
Notes: - Both events fire mainly at boot / sensor start, so use a time range that covers
at least one patch cycle (e.g. 30 days).
- AgentOnline can fire more than once per boot, so one reboot may show several times.