{"id":"T1059","name":"Command and Scripting Interpreter","url":"https://attack.mitre.org/techniques/T1059","tactics":["execution"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0516","stix_id":"x-mitre-detection-strategy--8582f5e6-44a5-4950-b7e8-a3e1b6d58d63","name":"Behavioral Detection of Command and Scripting Interpreter Abuse","url":"https://attack.mitre.org/detectionstrategies/DET0516","analytics":[{"id":"AN1428","stix_id":"x-mitre-analytic--fee823fd-f31e-4898-820e-322e49574438","name":"Analytic 1428","description":"Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.","url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1428","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"CommandLinePattern","description":"Tunable to match encoded or uncommon script execution patterns specific to the environment."},{"field":"ParentProcessName","description":"May vary across managed/unmanaged workstations or user-driven script activity."},{"field":"TimeWindow","description":"Used to restrict analysis to work hours or known admin maintenance windows."}],"live":true,"detection_strategies":["DET0516"],"techniques":["T1059"]},{"id":"AN1429","stix_id":"x-mitre-analytic--3b02d81a-8684-4fc8-8364-127f30359282","name":"Analytic 1429","description":"Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.","url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1429","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"InterpreterName","description":"Regex to identify which interpreters (bash, python, ruby) to monitor based on typical usage."},{"field":"UserContext","description":"Scope to users or service accounts not expected to run interpreters interactively."},{"field":"ExecutionChainLength","description":"Defines maximum process tree depth to correlate interpreter execution with its effects."}],"live":true,"detection_strategies":["DET0516"],"techniques":["T1059"]},{"id":"AN1430","stix_id":"x-mitre-analytic--4a32d0e6-9486-4bbb-8807-7f913f96f448","name":"Analytic 1430","description":"Detects launch of command-line interpreters via Terminal, Automator, or hidden `osascript`, especially when parent process lineage deviates from user-initiated applications.","url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1430","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"log stream --info --predicate 'eventMessage CONTAINS \"exec\"'","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"LaunchAgentName","description":"Monitor for specific plist agents frequently abused for persistence or payload execution."},{"field":"ScriptName","description":"Path or script name pattern (e.g., hidden files, /tmp locations)."},{"field":"TerminalAppUsage","description":"Adjust based on whether Terminal.app use is common or restricted in user policy."}],"live":true,"detection_strategies":["DET0516"],"techniques":["T1059"]},{"id":"AN1431","stix_id":"x-mitre-analytic--533d13df-5317-45dd-a544-c26d0192d6b2","name":"Analytic 1431","description":"Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.","url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1431","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vobd","channel":"shell session start","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-vobd"}],"mutable_elements":[{"field":"ShellEnabledFlag","description":"Control alerting based on whether ESXi shell access is typically disabled."},{"field":"SSHContext","description":"Scope detection to SSH session origins or internal vs. remote access."}],"live":true,"detection_strategies":["DET0516"],"techniques":["T1059"]},{"id":"AN1432","stix_id":"x-mitre-analytic--9e03886b-155c-4483-9d92-dad6a7d8543b","name":"Analytic 1432","description":"Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via `enable` mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.","url":"https://attack.mitre.org/detectionstrategies/DET0516#AN1432","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:cli","channel":"shell command","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-cli"},{"name":"networkdevice:syslog","channel":"authentication & authorization","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"UserRole","description":"Which roles or privilege levels should be monitored for interpreter misuse."},{"field":"DeviceType","description":"Support filtering for routers, switches, firewalls depending on network segmentation."}],"live":true,"detection_strategies":["DET0516"],"techniques":["T1059"]}],"live":true,"version":"1.0","techniques":["T1059"]}],"sigma_rules":[{"id":"0250638a-2b28-4541-86fc-ea4c558fa0c6","title":"Suspicious Browser Child Process - MacOS","author":"Sohan G (D4rkCiph3r)","status":"test","level":"medium","date":"2023-04-05","modified":null,"description":"Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.","references":["https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang","https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_initial_access_suspicious_browser_childproc.toml"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.initial-access","attack.execution","attack.t1189","attack.t1203","attack.t1059"],"path":"rules/macos/process_creation/proc_creation_macos_susp_browser_child_process.yml","techniques":["T1189","T1203","T1059"],"cves":[]},{"id":"05ebafc8-7aa2-4bcd-a269-2aec93f9e842","title":"Add New Download Source To Winget","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-04-17","modified":null,"description":"Detects usage of winget to add new additional download sources","references":["https://learn.microsoft.com/en-us/windows/package-manager/winget/source","https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_winget_add_custom_source.yml","techniques":["T1059"],"cves":[]},{"id":"06b401f4-107c-4ff9-947f-9ec1e7649f1e","title":"Potential Arbitrary Command Execution Via FTP.EXE","author":"Victor Sergeev, oscd.community","status":"test","level":"medium","date":"2020-10-09","modified":"2024-04-23","description":"Detects execution of \"ftp.exe\" script with the \"-s\" or \"/s\" flag and any child processes ran by \"ftp.exe\".","references":["https://lolbas-project.github.io/lolbas/Binaries/Ftp/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_ftp_arbitrary_command_execution.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2","title":"Use of Pcalua For Execution","author":"Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community","status":"test","level":"medium","date":"2022-06-14","modified":"2023-01-04","description":"Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.","references":["https://lolbas-project.github.io/lolbas/Binaries/Pcalua/","https://pentestlab.blog/2020/07/06/indirect-command-execution/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_pcalua.yml","techniques":["T1059"],"cves":[]},{"id":"11bb9b26-4179-4a06-afcb-1ec31fce1627","title":"Shai-Hulud Malware Indicators - Linux","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-25","modified":null,"description":"Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.\n","references":["https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack","https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains","https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hulud_indicator.yml","techniques":["T1059"],"cves":[]},{"id":"1228c958-e64e-4e71-92ad-7d429f4138ba","title":"Script Interpreter Execution From Suspicious Folder","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-02-08","modified":"2026-02-17","description":"Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.\nScript interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.\n","references":["https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-ukraine-military","https://learn.microsoft.com/en-us/windows/win32/shell/csidl"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml","techniques":["T1059"],"cves":[]},{"id":"12310575-e8b1-475c-a976-57ed540b349c","title":"DNS Request From Windows Script Host","author":"Josh Nickels, Marius Rothenbücher","status":"test","level":"low","date":"2024-09-06","modified":null,"description":"Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.\n","references":["Internal Research"],"logsource":{"product":"windows","category":"dns_query"},"tags":["attack.execution","attack.t1059"],"path":"rules-placeholder/windows/dns_query/dns_query_win_wscript_cscript_resolution.yml","techniques":["T1059"],"cves":[]},{"id":"1277f594-a7d1-4f28-a2d3-73af5cbeab43","title":"Windows Shell/Scripting Application File Write to Suspicious Folder","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-11-20","modified":"2023-03-29","description":"Detects Windows shells and scripting applications that write files to suspicious folders","references":["Internal Research"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/file/file_event/file_event_win_shell_write_susp_directory.yml","techniques":["T1059"],"cves":[]},{"id":"178e615d-e666-498b-9630-9ed363038101","title":"Elevated System Shell Spawned From Uncommon Parent Location","author":"frack113, Tim Shelton (update fp)","status":"test","level":"medium","date":"2022-12-05","modified":"2025-03-06","description":"Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.","references":["https://github.com/Wh04m1001/SysmonEoP"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_susp_elevated_system_shell_uncommon_parent.yml","techniques":["T1059"],"cves":[]},{"id":"1a433e1d-03d2-47a6-8063-ece992cf4e73","title":"DarkGate - Autoit3.EXE File Creation By Uncommon Process","author":"Micah Babinski","status":"test","level":"medium","date":"2023-10-15","modified":null,"description":"Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe.\nThis activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs\nprocess injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other\nprocesses consitute non-standard and suspicious ways to retrieve the Autoit3 executable.\n","references":["https://github.security.telekom.com/2023/08/darkgate-loader.html","https://www.kroll.com/en/insights/publications/cyber/microsoft-teams-used-as-initial-access-for-darkgate-malware","https://github.com/pr0xylife/DarkGate/tree/main"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.command-and-control","attack.execution","attack.t1105","attack.t1059","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Malware/DarkGate/file_event_win_malware_darkgate_autoit3_binary_creation.yml","techniques":["T1105","T1059"],"cves":[]},{"id":"1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db","title":"CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"medium","date":"2023-11-14","modified":null,"description":"Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.\n","references":["https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html","https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment","https://github.com/ForceFledgling/CVE-2023-22518"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","attack.initial-access","attack.t1190","cve.2023-22518","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_win_exploit_cve_2023_22518_confluence_tomcat_child_proc.yml","techniques":["T1059","T1190"],"cves":["CVE-2023-22518"]},{"id":"20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8","title":"Ruby Inline Command Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-02","modified":null,"description":"Detects execution of ruby using the \"-e\" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.","references":["https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet","https://www.revshells.com/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_ruby_inline_command_execution.yml","techniques":["T1059"],"cves":[]},{"id":"234dc5df-40b5-49d1-bf53-0d44ce778eca","title":"Payload Decoded and Decrypted via Built-in Utilities","author":"Tim Rauch (rule), Elastic (idea)","status":"test","level":"medium","date":"2022-10-17","modified":null,"description":"Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.","references":["https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d42c3d772e04f1e8d0eb60f5233bc79def1ea73105a2d8822f44164f77ef823"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.stealth","attack.t1059","attack.t1204","attack.execution","attack.t1140","attack.s0482","attack.s0402"],"path":"rules/macos/process_creation/proc_creation_macos_payload_decoded_and_decrypted.yml","techniques":["T1059","T1204","T1140"],"cves":[]},{"id":"236d8e89-ed95-4789-a982-36f4643738ba","title":"Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-06-14","modified":null,"description":"Detects execution of the \"VMwareToolBoxCmd.exe\" with the \"script\" and \"set\" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state","references":["https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence_susp.yml","techniques":["T1059"],"cves":[]},{"id":"2433a154-bb3d-42e4-86c3-a26bdac91c45","title":"Renamed PingCastle Binary Execution","author":"Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)","status":"test","level":"high","date":"2024-01-11","modified":null,"description":"Detects the execution of a renamed \"PingCastle\" binary based on the PE metadata fields.","references":["https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/","https://www.pingcastle.com/documentation/scanner/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_renamed_pingcastle.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"24474469-bd80-46cc-9e08-9fbe81bfaaca","title":"Potential KamiKakaBot Activity - Lure Document Execution","author":"Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)","status":"test","level":"medium","date":"2024-03-22","modified":null,"description":"Detects the execution of a Word document via the WinWord Start Menu shortcut.\nThis behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.\n","references":["https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","detection.emerging-threats"],"path":"rules-emerging-threats/2024/Malware/KamiKakaBot/proc_creation_win_malware_kamikakabot_lnk_lure_execution.yml","techniques":["T1059"],"cves":[]},{"id":"24549159-ac1b-479c-8175-d42aea947cae","title":"Hacktool Ruler","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-05-31","modified":"2022-10-09","description":"This events that are generated when using the hacktool Ruler by Sensepost","references":["https://github.com/sensepost/ruler","https://github.com/sensepost/ruler/issues/47","https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624"],"logsource":{"product":"windows","service":"security"},"tags":["attack.discovery","attack.execution","attack.collection","attack.lateral-movement","attack.t1087","attack.t1114","attack.t1059","attack.t1550.002"],"path":"rules/windows/builtin/security/win_security_alert_ruler.yml","techniques":["T1087","T1114","T1059","T1550.002"],"cves":[]},{"id":"245f92e3-c4da-45f1-9070-bc552e06db11","title":"Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt","author":"Bhabesh Raj","status":"test","level":"high","date":"2021-09-08","modified":"2023-02-13","description":"Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-26084","https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html","https://github.com/h3v0x/CVE-2021-26084_Confluence"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.execution","attack.t1190","attack.t1059","cve.2021-26084","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-26084/proc_creation_win_exploit_cve_2021_26084_atlassian_confluence.yml","techniques":["T1190","T1059"],"cves":["CVE-2021-26084"]},{"id":"24c4d154-05a4-4b99-b57d-9b977472443a","title":"Lazarus Group Activity","author":"Florian Roth (Nextron Systems), wagga","status":"test","level":"critical","date":"2020-12-23","modified":"2023-03-10","description":"Detects different process execution behaviors as described in various threat reports on Lazarus group activity","references":["https://securelist.com/lazarus-covets-covid-19-related-intelligence/99906/","https://www.hvs-consulting.de/lazarus-report/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.g0032","attack.execution","attack.t1059","detection.emerging-threats"],"path":"rules-emerging-threats/2020/TA/Lazarus/proc_creation_win_apt_lazarus_group_activity.yml","techniques":["T1059"],"cves":[]},{"id":"264982dc-dbad-4dce-b707-1e0d3e0f73d9","title":"Renamed NirCmd.EXE Execution","author":"X__Junior (Nextron Systems)","status":"test","level":"high","date":"2024-03-11","modified":null,"description":"Detects the execution of a renamed \"NirCmd.exe\" binary based on the PE metadata fields.","references":["https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/","https://www.nirsoft.net/utils/nircmd.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_renamed_nircmd.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"271de298-cc0e-4842-acd8-079a0a99ea65","title":"Windows Suspicious Child Process from Node.js - React2Shell","author":"Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali","status":"experimental","level":"high","date":"2025-12-05","modified":null,"description":"Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell).\nAttackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync().\nIf execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked.\nFor other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.\n","references":["https://github.com/msanft/CVE-2025-55182","https://nodejs.org/api/child_process.html#class-childprocess","https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870","https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","attack.initial-access","attack.t1190","detection.emerging-threats","cve.2025-55182"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_win_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml","techniques":["T1059","T1190"],"cves":["CVE-2025-55182"]},{"id":"277a4393-446c-449a-b0ed-7fdc7795244c","title":"Renamed FTP.EXE Execution","author":"Victor Sergeev, oscd.community","status":"test","level":"medium","date":"2020-10-09","modified":"2023-02-03","description":"Detects the execution of a renamed \"ftp.exe\" binary based on the PE metadata fields","references":["https://lolbas-project.github.io/lolbas/Binaries/Ftp/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_renamed_ftp.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"297241f3-8108-4b3a-8c15-2dda9f844594","title":"Suspicious Invocation of Shell via Rsync","author":"Florian Roth","status":"experimental","level":"high","date":"2025-01-18","modified":null,"description":"Detects the execution of a shell as sub process of \"rsync\" without the expected command line flag \"-e\" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.\n","references":["https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/","https://gist.github.com/Neo23x0/a20436375a1e26524931dd8ea1a3af10"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059","attack.t1203"],"path":"rules/linux/process_creation/proc_creation_lnx_rsync_shell_spawn.yml","techniques":["T1059","T1203"],"cves":[]},{"id":"2c28c248-7f50-417a-9186-a85b223010ee","title":"Wscript Shell Run In CommandLine","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-31","modified":"2023-05-15","description":"Detects the presence of the keywords \"Wscript\", \"Shell\" and \"Run\" in the command, which could indicate a suspicious activity","references":["https://web.archive.org/web/20220830122045/http://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html","https://blog.talosintelligence.com/modernloader-delivers-multiple-stealers-cryptominers-and-rats/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_mshta_inline_vbscript.yml","techniques":["T1059"],"cves":[]},{"id":"2d2f44ff-4611-4778-a8fc-323a0e9850cc","title":"Inline Python Execution - Spawn Shell Via OS System Library","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","status":"test","level":"high","date":"2024-09-02","modified":null,"description":"Detects execution of inline Python code via the \"-c\" in order to call the \"system\" function from the \"os\" library, and spawn a shell.\n","references":["https://gtfobins.github.io/gtfobins/python/#shell"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/linux/process_creation/proc_creation_lnx_python_shell_os_system.yml","techniques":["T1059"],"cves":[]},{"id":"313d6012-51a0-4d93-8dfc-de8553239e25","title":"Install New Package Via Winget Local Manifest","author":"Sreeman, Florian Roth (Nextron Systems), frack113","status":"test","level":"medium","date":"2020-04-21","modified":"2023-04-17","description":"Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them.\nThe manifest option enables you to install an application by passing in a YAML file directly to the client.\nWinget can be used to download and install exe, msi or msix files later.\n","references":["https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install","https://lolbas-project.github.io/lolbas/Binaries/Winget/","https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml","techniques":["T1059"],"cves":[]},{"id":"39ac1fb0-07f1-474b-b97e-c5c0eace0d79","title":"Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE","author":"@kostastsale","status":"test","level":"medium","date":"2023-06-01","modified":null,"description":"Detects the execution of \"csc.exe\" via \"w3wp.exe\" process. MOVEit affected hosts execute \"csc.exe\" via the \"w3wp.exe\" process to dynamically compile malicious DLL files.\n\nMOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\\\\Windows\\\\Microsoft\\.NET\\\\Framework64\\\\v4\\.0\\.30319\\\\Temporary ASP\\.NET Files\\\\root\\\\([a-z0-9]{5,12})\\\\([a-z0-9]{5,12})\\\\App_Web_[a-z0-9]{5,12}\\.dll.\n\nHunting Opportunity\n\nEvents from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.\n","references":["https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response","https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","cve.2023-34362","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/proc_creation_win_exploit_cve_2023_34362_moveit_transfer_exploitation_activity.yml","techniques":["T1059"],"cves":["CVE-2023-34362"]},{"id":"42333b2c-b425-441c-b70e-99404a17170f","title":"HackTool - Sliver C2 Implant Activity Pattern","author":"Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2022-08-25","modified":"2023-03-05","description":"Detects process activity patterns as seen being used by Sliver C2 framework implants","references":["https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/implant/sliver/shell/shell_windows.go#L36","https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern.yml","techniques":["T1059"],"cves":[]},{"id":"47b3bbd4-1bf7-48cc-84ab-995362aaa75a","title":"Shell Execution via Git - Linux","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","status":"test","level":"high","date":"2024-09-02","modified":null,"description":"Detects the use of the \"git\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n","references":["https://gtfobins.github.io/gtfobins/git/#shell"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/linux/process_creation/proc_creation_lnx_git_shell_execution.yml","techniques":["T1059"],"cves":[]},{"id":"480e7e51-e797-47e3-8d72-ebfce65b6d8d","title":"Python Spawning Pretty TTY on Windows","author":"Nextron Systems","status":"test","level":"high","date":"2022-06-03","modified":null,"description":"Detects python spawning a pretty tty","references":["https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_python_pty_spawn.yml","techniques":["T1059"],"cves":[]},{"id":"4b991083-3d0e-44ce-8fc4-b254025d8d4b","title":"Unusual Parent Process For Cmd.EXE","author":"Tim Rauch, Elastic (idea)","status":"test","level":"medium","date":"2022-09-21","modified":"2023-12-05","description":"Detects suspicious parent process for cmd.exe","references":["https://www.elastic.co/guide/en/security/current/unusual-parent-process-for-cmd.exe.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_cmd_unusual_parent.yml","techniques":["T1059"],"cves":[]},{"id":"4e25af4b-246d-44ea-8563-e42aacab006b","title":"Potential Xterm Reverse Shell","author":"@d4ns4n_","status":"test","level":"medium","date":"2023-04-24","modified":null,"description":"Detects usage of \"xterm\" as a potential reverse shell tunnel","references":["https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet","https://www.revshells.com/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/linux/process_creation/proc_creation_lnx_xterm_reverse_shell.yml","techniques":["T1059"],"cves":[]},{"id":"540703fb-a874-4385-a9d6-7cd1bfab268c","title":"Shai-Hulud Malware Indicators - Windows","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-25","modified":null,"description":"Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.\n","references":["https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack","https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains","https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_indicator.yml","techniques":["T1059"],"cves":[]},{"id":"55f0a3a1-846e-40eb-8273-677371b8d912","title":"Outlook EnableUnsafeClientMailRules Setting Enabled","author":"Markus Neis, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2018-12-27","modified":"2023-02-09","description":"Detects an attacker trying to enable the outlook security setting \"EnableUnsafeClientMailRules\" which allows outlook to run applications or execute macros","references":["https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html","https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44","https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"5687f942-867b-4578-ade7-1e341c46e99a","title":"VMToolsd Suspicious Child Process","author":"bohops, Bhabesh Raj","status":"test","level":"high","date":"2021-10-08","modified":"2023-07-25","description":"Detects suspicious child process creations of VMware Tools process which may indicate persistence setup","references":["https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/","https://user-images.githubusercontent.com/61026070/136518004-b68cce7d-f9b8-4e9a-9b7b-53b1568a9a94.png","https://github.com/vmware/open-vm-tools/blob/master/open-vm-tools/tools.conf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_vmware_vmtoolsd_susp_child_process.yml","techniques":["T1059"],"cves":[]},{"id":"57b649ef-ff42-4fb0-8bf6-62da243a1708","title":"Windows Defender Threat Detected","author":"Ján Trenčanský","status":"stable","level":"high","date":"2020-07-28","modified":null,"description":"Detects actions taken by Windows Defender malware detection engines","references":["https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus"],"logsource":{"product":"windows","service":"windefend"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/builtin/windefend/win_defender_threat.yml","techniques":["T1059"],"cves":[]},{"id":"5de632bc-7fbd-4c8a-944a-fce55c59eae5","title":"REvil Kaseya Incident Malware Patterns","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2021-07-03","modified":"2022-05-20","description":"Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)","references":["https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers","https://www.joesandbox.com/analysis/443736/0/html","https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b","https://therecord.media/revil-ransomware-executes-supply-chain-attack-via-malicious-kaseya-update/","https://blog.truesec.com/2021/07/04/kaseya-supply-chain-attack-targeting-msps-to-deliver-revil-ransomware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","attack.g0115","detection.emerging-threats"],"path":"rules-emerging-threats/2021/TA/Kaseya-Supply-Chain/proc_creation_win_apt_revil_kaseya.yml","techniques":["T1059"],"cves":[]},{"id":"61065c72-5d7d-44ef-bf41-6a36684b545f","title":"Elevated System Shell Spawned","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"medium","date":"2023-11-23","modified":"2025-03-06","description":"Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.\n","references":["https://github.com/Wh04m1001/SysmonEoP"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.t1059","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_susp_elevated_system_shell.yml","techniques":["T1059"],"cves":[]},{"id":"69bd9b97-2be2-41b6-9816-fb08757a4d1a","title":"Potentially Suspicious Execution From Parent Process In Public Folder","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-02-25","modified":"2024-07-12","description":"Detects a potentially suspicious execution of a parent process located in the \"\\Users\\Public\" folder executing a child process containing references to shell or scripting binaries and commandlines.\n","references":["https://redcanary.com/blog/blackbyte-ransomware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1564","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_susp_execution_from_public_folder_as_parent.yml","techniques":["T1564","T1059"],"cves":[]},{"id":"6bba49bf-7f8c-47d6-a1bb-6b4dece4640e","title":"Suspicious RASdial Activity","author":"juju4","status":"test","level":"medium","date":"2019-01-16","modified":"2021-11-27","description":"Detects suspicious process related to rasdial.exe","references":["https://twitter.com/subTee/status/891298217907830785"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_rasdial_execution.yml","techniques":["T1059"],"cves":[]},{"id":"6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4","title":"Suspicious Execution via macOS Script Editor","author":"Tim Rauch (rule), Elastic (idea)","status":"test","level":"medium","date":"2022-10-21","modified":"2022-12-28","description":"Detects when the macOS Script Editor utility spawns an unusual child process.","references":["https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-7f541fbc4a4a28a92970e8bf53effea5bd934604429112c920affb457f5b2685","https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1566","attack.t1566.002","attack.initial-access","attack.t1059","attack.t1059.002","attack.t1204","attack.t1204.001","attack.execution","attack.persistence","attack.t1553"],"path":"rules/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml","techniques":["T1566","T1566.002","T1059","T1059.002","T1204","T1204.001","T1553"],"cves":[]},{"id":"6e90ae7a-7cd3-473f-a035-4ebb72d961da","title":"PCRE.NET Package Temp Files","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"high","date":"2020-10-29","modified":"2022-10-09","description":"Detects processes creating temp files related to PCRE.NET package","references":["https://twitter.com/rbmaslen/status/1321859647091970051","https://twitter.com/tifkin_/status/1321916444557365248"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/file/file_event/file_event_win_pcre_net_temp_file.yml","techniques":["T1059"],"cves":[]},{"id":"72af37e2-ec32-47dc-992b-bc288a2708cb","title":"Azure New CloudShell Created","author":"Austin Songer","status":"test","level":"medium","date":"2021-09-21","modified":"2022-08-23","description":"Identifies when a new cloudshell is created inside of Azure portal.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.execution","attack.t1059"],"path":"rules/cloud/azure/activity_logs/azure_new_cloudshell_created.yml","techniques":["T1059"],"cves":[]},{"id":"7530cd3d-7671-43e3-b209-976966f6ea48","title":"Renamed CURL.EXE Execution","author":"X__Junior (Nextron Systems)","status":"test","level":"medium","date":"2023-09-11","modified":"2023-10-12","description":"Detects the execution of a renamed \"CURL.exe\" binary based on the PE metadata fields","references":["https://twitter.com/Kostastsale/status/1700965142828290260"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_renamed_curl.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"799a5f48-0ac1-4e0f-9152-71d137d48c2a","title":"Abusable DLL Potential Sideloading From Suspicious Location","author":"X__Junior (Nextron Systems)","status":"test","level":"high","date":"2023-07-11","modified":null,"description":"Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations","references":["https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html","https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/image_load/image_load_side_load_abused_dlls_susp_paths.yml","techniques":["T1059"],"cves":[]},{"id":"7a4d9232-92fc-404d-8ce1-4c92e7caf539","title":"HackTool - Stracciatella Execution","author":"pH-T (Nextron Systems)","status":"test","level":"high","date":"2023-04-17","modified":"2024-11-23","description":"Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.","references":["https://github.com/mgeeky/Stracciatella"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.defense-impairment","attack.t1059","attack.t1685"],"path":"rules/windows/process_creation/proc_creation_win_hktl_stracciatella_execution.yml","techniques":["T1059","T1685"],"cves":[]},{"id":"7aa4e81a-a65c-4e10-9f81-b200eb229d7d","title":"Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-06-14","modified":null,"description":"Detects execution of the \"VMwareToolBoxCmd.exe\" with the \"script\" and \"set\" flag to setup a specific script to run for a specific VM state","references":["https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/","https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence.yml","techniques":["T1059"],"cves":[]},{"id":"7aaa5739-12fc-41aa-b98b-23ec27d42bdf","title":"Ursnif Redirection Of Discovery Commands","author":"@kostastsale","status":"test","level":"high","date":"2023-07-16","modified":null,"description":"Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.\n","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Malware/Ursnif/proc_creation_win_malware_ursnif_cmd_redirection.yml","techniques":["T1059"],"cves":[]},{"id":"7ab8f73a-fcff-428b-84aa-6a5ff7877dea","title":"Vim GTFOBin Abuse - Linux","author":"Nasreddine Bencherchali (Nextron Systems), Luc Génaux","status":"test","level":"high","date":"2022-12-28","modified":"2026-06-05","description":"Detects the use of \"vim\" and it's siblings commands to execute a shell or proxy commands.\nSuch behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n","references":["https://gtfobins.github.io/gtfobins/vi/","https://gtfobins.github.io/gtfobins/vim/","https://gtfobins.github.io/gtfobins/rvim/","https://gtfobins.github.io/gtfobins/vimdiff/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.discovery","attack.t1059","attack.t1083"],"path":"rules/linux/process_creation/proc_creation_lnx_vim_shell_execution.yml","techniques":["T1059","T1083"],"cves":[]},{"id":"7f734ed0-4f47-46c0-837f-6ee62505abd9","title":"Potential Netcat Reverse Shell Execution","author":"@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-04-07","modified":null,"description":"Detects execution of netcat with the \"-e\" flag followed by common shells. This could be a sign of a potential reverse shell setup.","references":["https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet","https://www.revshells.com/","https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/","https://www.infosecademy.com/netcat-reverse-shells/","https://man7.org/linux/man-pages/man1/ncat.1.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/linux/process_creation/proc_creation_lnx_netcat_reverse_shell.yml","techniques":["T1059"],"cves":[]},{"id":"7fb14105-530e-4e2e-8cfb-99f7d8700b66","title":"Atlassian Confluence CVE-2022-26134","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-03","modified":null,"description":"Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134","references":["https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.initial-access","attack.execution","attack.t1190","attack.t1059","cve.2022-26134","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-26134/proc_creation_lnx_exploit_cve_2022_26134_atlassian_confluence.yml","techniques":["T1190","T1059"],"cves":["CVE-2022-26134"]},{"id":"808146b2-9332-4d78-9416-d7e47012d83d","title":"BPFDoor Abnormal Process ID or Lock File Accessed","author":"Rafal Piasecki","status":"test","level":"high","date":"2022-08-10","modified":"2026-03-30","description":"detects BPFDoor .lock and .pid files access in temporary file storage facility","references":["https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/","https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor","https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/","https://github.com/rapid7/Rapid7-Labs/blob/741c7196ec12a0a56b63463d1fd726ff14d3a97a/BPFDoor/rapid7_detect_bpfdoor.sh"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.execution","attack.t1106","attack.t1059"],"path":"rules/linux/auditd/path/lnx_auditd_bpfdoor_file_accessed.yml","techniques":["T1106","T1059"],"cves":[]},{"id":"814c95cc-8192-4378-a70a-f1aafd877af1","title":"Use of OpenConsole","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-06-16","modified":null,"description":"Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting","references":["https://twitter.com/nas_bench/status/1537563834478645252"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_openconsole.yml","techniques":["T1059"],"cves":[]},{"id":"81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2","title":"Add Insecure Download Source To Winget","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-04-17","modified":null,"description":"Detects usage of winget to add a new insecure (http) download source.\nWinget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)\n","references":["https://learn.microsoft.com/en-us/windows/package-manager/winget/source","https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_winget_add_insecure_custom_source.yml","techniques":["T1059"],"cves":[]},{"id":"84b0a8f3-680b-4096-a45b-e9a89221727c","title":"PCRE.NET Package Image Load","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"high","date":"2020-10-29","modified":"2022-10-09","description":"Detects processes loading modules related to PCRE.NET package","references":["https://twitter.com/rbmaslen/status/1321859647091970051","https://twitter.com/tifkin_/status/1321916444557365248"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/image_load/image_load_dll_pcre_dotnet_dll_load.yml","techniques":["T1059"],"cves":[]},{"id":"85b0b087-eddf-4a2b-b033-d771fa2b9775","title":"PowerShell Download and Execution Cradles","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-03-24","modified":"2025-07-18","description":"Detects PowerShell download and execution cradles.","references":["https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd","https://labs.withsecure.com/publications/fin7-target-veeam-servers"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_powershell_download_iex.yml","techniques":["T1059"],"cves":[]},{"id":"8737b7f6-8df3-4bb7-b1da-06019b99b687","title":"Shell Invocation Via Ssh - Linux","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","status":"test","level":"high","date":"2024-08-29","modified":null,"description":"Detects the use of the \"ssh\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n","references":["https://gtfobins.github.io/gtfobins/ssh/","https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/linux/process_creation/proc_creation_lnx_ssh_shell_execution.yml","techniques":["T1059"],"cves":[]},{"id":"894397c6-da03-425c-a589-3d09e7d1f750","title":"Potential CVE-2021-40444 Exploitation Attempt","author":"Florian Roth (Nextron Systems), @neonprimetime","status":"test","level":"high","date":"2021-09-08","modified":"2023-02-04","description":"Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444","https://twitter.com/neonprimetime/status/1435584010202255375","https://www.joesandbox.com/analysis/476188/1/iochtml"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","cve.2021-40444","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444.yml","techniques":["T1059"],"cves":["CVE-2021-40444"]},{"id":"899133d5-4d7c-4a7f-94ee-27355c879d90","title":"Python Inline Command Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-02","modified":"2025-10-07","description":"Detects execution of python using the \"-c\" flag. This is could be used as a way to launch a reverse shell or execute live python code.","references":["https://docs.python.org/3/using/cmdline.html#cmdoption-c","https://www.revshells.com/","https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml","techniques":["T1059"],"cves":[]},{"id":"8c1a5675-cb85-452f-a298-b01b22a51856","title":"Suspicious Invocation of Shell via AWK - Linux","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","status":"test","level":"high","date":"2024-09-02","modified":null,"description":"Detects the execution of \"awk\" or it's sibling commands, to invoke a shell using the system() function.\nThis behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.\n","references":["https://gtfobins.github.io/gtfobins/awk/#shell","https://gtfobins.github.io/gtfobins/gawk/#shell","https://gtfobins.github.io/gtfobins/nawk/#shell","https://gtfobins.github.io/gtfobins/mawk/#shell"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/linux/process_creation/proc_creation_lnx_awk_shell_spawn.yml","techniques":["T1059"],"cves":[]},{"id":"8e95e73e-ba02-4a87-b4d7-0929b8053038","title":"Suspicious ArcSOC.exe Child Process","author":"Micah Babinski","status":"experimental","level":"high","date":"2025-11-25","modified":null,"description":"Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe.\nArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS\nServer system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding\nservice endpoint and remotely execute code from the ArcSOC.exe process.\n","references":["https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/","https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","attack.t1203"],"path":"rules/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml","techniques":["T1059","T1203"],"cves":[]},{"id":"95724fc1-a258-4674-97db-a30351981c5a","title":"Manual Execution of Script Inside of a Compressed File","author":"@kostastsale","status":"test","level":"medium","date":"2023-02-15","modified":"2024-08-13","description":"This is a threat-hunting query to collect information related to the interactive execution of a script from inside a compressed file (zip/rar). Windows will automatically run the script using scripting interpreters such as wscript and cscript binaries.\n\nFrom the query below, the child process is the script interpreter that will execute the script. The script extension is also a set of standard extensions that Windows OS recognizes. Selections 1-3 contain three different execution scenarios.\n    1. Compressed file opened using 7zip.\n    2. Compressed file opened using WinRar.\n    3. Compressed file opened using native windows File Explorer capabilities.\n\nWhen the malicious script is double-clicked, it will be extracted to the respected directories as signified by the CommandLine on each of the three Selections. It will then be executed using the relevant script interpreter.\"\n","references":["https://app.any.run/tasks/25970bb5-f864-4e9e-9e1b-cc8ff9e6386a","https://app.any.run/tasks/fa99cedc-9d2f-4115-a08e-291429ce3692"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_susp_script_exec_from_compressed_parent.yml","techniques":["T1059"],"cves":[]},{"id":"9aa5106d-bce3-4b13-86df-3a20f1d5cf0b","title":"Forfiles Command Execution","author":"Tim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community","status":"test","level":"medium","date":"2022-06-14","modified":"2024-03-05","description":"Detects the execution of \"forfiles\" with the \"/c\" flag.\nWhile this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary.\nCan be used to bypass application whitelisting.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Forfiles/","https://pentestlab.blog/2020/07/06/indirect-command-execution/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_forfiles_proxy_execution_.yml","techniques":["T1059"],"cves":[]},{"id":"a77c1610-fc73-4019-8e29-0f51efc04a51","title":"Potential Dosfuscation Activity","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-02-15","modified":"2023-03-06","description":"Detects possible payload obfuscation via the commandline","references":["https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf","https://github.com/danielbohannon/Invoke-DOSfuscation"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_cmd_dosfuscation.yml","techniques":["T1059"],"cves":[]},{"id":"ae9b0bd7-8888-4606-b444-0ed7410cb728","title":"Writing Of Malicious Files To The Fonts Folder","author":"Sreeman","status":"test","level":"medium","date":"2020-04-21","modified":"2022-03-08","description":"Monitors for the hiding possible malicious files in the C:\\Windows\\Fonts\\ location. This folder doesn't require admin privillege to be written and executed from.","references":["https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1211","attack.t1059","attack.persistence","attack.execution"],"path":"rules/windows/process_creation/proc_creation_win_susp_hiding_malware_in_fonts_folder.yml","techniques":["T1211","T1059"],"cves":[]},{"id":"afe52666-401e-4a02-b4ff-5d128990b8cb","title":"Suspicious Greedy Compression Using Rar.EXE","author":"X__Junior (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-12-15","modified":"2024-01-02","description":"Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes","references":["https://decoded.avast.io/martinchlumecky/png-steganography"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_rar_susp_greedy_compression.yml","techniques":["T1059"],"cves":[]},{"id":"b96b2031-7c17-4473-afe7-a30ce714db29","title":"Use of FSharp Interpreters","author":"Christopher Peacock @SecurePeacock, SCYTHE @scythe_io","status":"test","level":"medium","date":"2022-06-02","modified":"2024-04-23","description":"Detects the execution of FSharp Interpreters \"FsiAnyCpu.exe\" and \"FSi.exe\"\nBoth can be used for AWL bypass and to execute F# code via scripts or inline.\n","references":["https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac","https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/FsiAnyCpu/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Fsi/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_fsi_fsharp_code_execution.yml","techniques":["T1059"],"cves":[]},{"id":"bbb7e38c-0b41-4a11-b306-d2a457b7ac2b","title":"Suspicious File Created In PerfLogs","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-05-05","modified":null,"description":"Detects suspicious file based on their extension being created in \"C:\\PerfLogs\\\". Note that this directory mostly contains \".etl\" files","references":["Internal Research","https://labs.withsecure.com/publications/fin7-target-veeam-servers"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/file/file_event/file_event_win_perflogs_susp_files.yml","techniques":["T1059"],"cves":[]},{"id":"bdeeabc9-ff2a-4a51-be59-bb253aac7891","title":"PUA - Wsudo Suspicious Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-02","modified":"2023-02-14","description":"Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)","references":["https://github.com/M2Team/Privexec/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.privilege-escalation","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_pua_wsudo_susp_execution.yml","techniques":["T1059"],"cves":[]},{"id":"c0b2768a-dd06-4671-8339-b16ca8d1f27f","title":"Potentially Suspicious NTFS Symlink Behavior Modification","author":"frack113, The DFIR Report","status":"test","level":"medium","date":"2022-03-02","modified":"2025-11-13","description":"Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.\n","references":["https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware","https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior","https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.defense-impairment","attack.t1059","attack.t1222.001"],"path":"rules/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml","techniques":["T1059","T1222.001"],"cves":[]},{"id":"c1344fa2-323b-4d2e-9176-84b4d4821c88","title":"Windows Defender Exclusions Added - PowerShell","author":"Tim Rauch, Elastic (idea)","status":"test","level":"medium","date":"2022-09-16","modified":"2022-11-26","description":"Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions","references":["https://www.elastic.co/guide/en/security/current/windows-defender-exclusions-added-via-powershell.html"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.defense-impairment","attack.t1685","attack.execution","attack.t1059"],"path":"rules/windows/powershell/powershell_script/posh_ps_win_defender_exclusions_added.yml","techniques":["T1685","T1059"],"cves":[]},{"id":"c15a46a0-07d4-4c87-b4b6-89207835a83b","title":"Add Potential Suspicious New Download Source To Winget","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-04-17","modified":"2023-12-04","description":"Detects usage of winget to add new potentially suspicious download sources","references":["https://learn.microsoft.com/en-us/windows/package-manager/winget/source","https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_winget_add_susp_custom_source.yml","techniques":["T1059"],"cves":[]},{"id":"c4042d54-110d-45dd-a0e1-05c47822c937","title":"Python Spawning Pretty TTY Via PTY Module","author":"Nextron Systems","status":"test","level":"medium","date":"2022-06-03","modified":"2024-11-04","description":"Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.\n","references":["https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/linux/process_creation/proc_creation_lnx_python_pty_spawn.yml","techniques":["T1059"],"cves":[]},{"id":"c601f20d-570a-4cde-a7d6-e17f99cb8e7f","title":"Turla Group Lateral Movement","author":"Markus Neis","status":"test","level":"critical","date":"2017-11-07","modified":"2022-10-09","description":"Detects automated lateral movement by Turla group","references":["https://securelist.com/the-epic-turla-operation/65545/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.g0010","attack.execution","attack.t1059","attack.lateral-movement","attack.t1021.002","attack.discovery","attack.t1083","attack.t1135","detection.emerging-threats"],"path":"rules-emerging-threats/2014/TA/Turla/proc_creation_win_apt_turla_commands_critical.yml","techniques":["T1059","T1021.002","T1083","T1135"],"cves":[]},{"id":"c70834fa-fb9d-4aa0-9e7d-45ceed36f3f7","title":"Linux Suspicious Child Process from Node.js - React2Shell","author":"Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali","status":"experimental","level":"high","date":"2025-12-05","modified":null,"description":"Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell).\nThis rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands.\nWhen execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>).\nFor other methods, the Image field will show the spawned process directly.\n","references":["https://github.com/msanft/CVE-2025-55182","https://nodejs.org/api/child_process.html#class-childprocess","https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870","https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059","attack.initial-access","attack.t1190","detection.emerging-threats","cve.2025-55182"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_lnx_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml","techniques":["T1059","T1190"],"cves":["CVE-2025-55182"]},{"id":"c83bf4b5-cdf0-437c-90fa-43d734f7c476","title":"Run PowerShell Script from Redirected Input Stream","author":"Moriarty Meng (idea), Anton Kutepov (rule), oscd.community","status":"test","level":"high","date":"2020-10-17","modified":"2021-11-27","description":"Detects PowerShell script execution via input stream redirect","references":["https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OSBinaries/Powershell.yml","https://twitter.com/Moriarty_Meng/status/984380793383370752"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_powershell_run_script_from_input_stream.yml","techniques":["T1059"],"cves":[]},{"id":"cbb9e3d1-2386-4e59-912e-62f1484f7a89","title":"Conhost Spawned By Uncommon Parent Process","author":"Tim Rauch, Elastic (idea)","status":"test","level":"medium","date":"2022-09-28","modified":"2025-03-06","description":"Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.","references":["https://www.elastic.co/guide/en/security/current/conhost-spawned-by-suspicious-parent-process.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_conhost_uncommon_parent.yml","techniques":["T1059"],"cves":[]},{"id":"d292e0af-9a18-420c-9525-ec0ac3936892","title":"Suspicious Java Children Processes","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-03","modified":null,"description":"Detects java process spawning suspicious children","references":["https://www.tecmint.com/different-types-of-linux-shells/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_java_children.yml","techniques":["T1059"],"cves":[]},{"id":"d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e","title":"Sysprep on AppData Folder","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2018-06-22","modified":"2021-11-27","description":"Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)","references":["https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets","https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_sysprep_appdata.yml","techniques":["T1059"],"cves":[]},{"id":"d81871ef-5738-47ab-9797-7a9c90cd4bfb","title":"Php Inline Command Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-02","modified":null,"description":"Detects execution of php using the \"-r\" flag. This is could be used as a way to launch a reverse shell or execute live php code.","references":["https://www.php.net/manual/en/features.commandline.php","https://www.revshells.com/","https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_php_inline_command_execution.yml","techniques":["T1059"],"cves":[]},{"id":"db1ac3be-f606-4e3a-89e0-9607cbe6b98a","title":"Capsh Shell Invocation - Linux","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","status":"test","level":"high","date":"2024-09-02","modified":null,"description":"Detects the use of the \"capsh\" utility to invoke a shell.\n","references":["https://gtfobins.github.io/gtfobins/capsh/#shell","https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/linux/process_creation/proc_creation_lnx_capsh_shell_invocation.yml","techniques":["T1059"],"cves":[]},{"id":"df49c691-8026-48dd-94d3-4ba6a79102a8","title":"DarkGate - Drop DarkGate Loader In C:\\Temp Directory","author":"Tomasz Dyduch, Josh Nickels","status":"test","level":"medium","date":"2024-05-31","modified":null,"description":"Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\\temp folder.","references":["https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/","https://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.t1059","detection.emerging-threats"],"path":"rules-emerging-threats/2024/Malware/DarkGate/file_event_win_malware_darkgate_autoit3_save_temp.yml","techniques":["T1059"],"cves":[]},{"id":"e0cfaecd-602d-41af-988d-f6ccebb2af26","title":"Suspicious Installer Package Child Process","author":"Sohan G (D4rkCiph3r)","status":"test","level":"medium","date":"2023-02-18","modified":null,"description":"Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters","references":["https://redcanary.com/blog/clipping-silver-sparrows-wings/","https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.t1059","attack.t1059.007","attack.t1071","attack.t1071.001","attack.execution","attack.command-and-control"],"path":"rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml","techniques":["T1059","T1059.007","T1071","T1071.001"],"cves":[]},{"id":"e212d415-0e93-435f-9e1a-f29005bb4723","title":"Suspicious Remote Child Process From Outlook","author":"Markus Neis, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2018-12-27","modified":"2023-02-09","description":"Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).","references":["https://github.com/sensepost/ruler","https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html","https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=49"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes_remote.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"e2326866-609f-4015-aea9-7ec634e8aa04","title":"Shell Execution via Rsync - Linux","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth","status":"experimental","level":"high","date":"2024-09-02","modified":"2025-01-18","description":"Detects the use of the \"rsync\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n","references":["https://gtfobins.github.io/gtfobins/rsync/#shell"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/linux/process_creation/proc_creation_lnx_rsync_shell_execution.yml","techniques":["T1059"],"cves":[]},{"id":"ea9bf0fa-edec-4fb8-8b78-b119f2528186","title":"Windows Defender AMSI Trigger Detected","author":"Bhabesh Raj","status":"stable","level":"high","date":"2020-09-14","modified":"2022-12-07","description":"Detects triggering of AMSI by Windows Defender.","references":["https://learn.microsoft.com/en-us/windows/win32/amsi/how-amsi-helps"],"logsource":{"product":"windows","service":"windefend"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/builtin/windefend/win_defender_malware_detected_amsi_source.yml","techniques":["T1059"],"cves":[]},{"id":"eca49c87-8a75-4f13-9c73-a5a29e845f03","title":"Suspicious Runscripthelper.exe","author":"Victor Sergeev, oscd.community","status":"test","level":"medium","date":"2020-10-09","modified":"2022-07-11","description":"Detects execution of powershell scripts via Runscripthelper.exe","references":["https://lolbas-project.github.io/lolbas/Binaries/Runscripthelper/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"eca8ae39-5c3c-4321-b538-9e64fe25822e","title":"Installation of WSL Kali-Linux","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-10-10","modified":null,"description":"Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL).\nAttackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.\n","references":["https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e","https://learn.microsoft.com/en-us/windows/wsl/install"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_wsl_kali_linux_installation.yml","techniques":["T1059"],"cves":[]},{"id":"efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6","title":"Suspicious Program Names","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-11","modified":"2023-03-22","description":"Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_susp_progname.yml","techniques":["T1059"],"cves":[]},{"id":"f35c5d71-b489-4e22-a115-f003df287317","title":"Potential CobaltStrike Process Patterns","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2021-07-27","modified":"2023-03-29","description":"Detects potential process patterns related to Cobalt Strike beacon activity","references":["https://hausec.com/2021/07/26/cobalt-strike-and-tradecraft/","https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_process_patterns.yml","techniques":["T1059"],"cves":[]},{"id":"f426547a-e0f7-441a-b63e-854ac5bdf54d","title":"Perl Inline Command Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-02","modified":null,"description":"Detects execution of perl using the \"-e\"/\"-E\" flags. This is could be used as a way to launch a reverse shell or execute live perl code.","references":["https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet","https://www.revshells.com/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/process_creation/proc_creation_win_perl_inline_command_execution.yml","techniques":["T1059"],"cves":[]},{"id":"f8987c03-4290-4c96-870f-55e75ee377f4","title":"CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"high","date":"2023-11-14","modified":null,"description":"Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.\n","references":["https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html","https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment","https://github.com/ForceFledgling/CVE-2023-22518"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059","attack.initial-access","attack.t1190","cve.2023-22518","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_lnx_exploit_cve_2023_22518_confluence_java_child_proc.yml","techniques":["T1059","T1190"],"cves":["CVE-2023-22518"]},{"id":"f8ad2e2c-40b6-4117-84d7-20b89896ab23","title":"Suspicious Scan Loop Network","author":"frack113","status":"test","level":"medium","date":"2022-03-12","modified":null,"description":"Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md","https://ss64.com/nt/for.html","https://ss64.com/ps/foreach-object.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","attack.discovery","attack.t1018"],"path":"rules/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml","techniques":["T1059","T1018"],"cves":[]},{"id":"f8e9aa1c-14f2-4dbd-aa59-b98968ed650d","title":"DarkGate - Autoit3.EXE Execution Parameters","author":"Micah Babinski","status":"test","level":"high","date":"2023-10-15","modified":null,"description":"Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within\nthe DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate\ncommand-and-control server.\n","references":["https://github.security.telekom.com/2023/08/darkgate-loader.html","https://www.kroll.com/en/insights/publications/cyber/microsoft-teams-used-as-initial-access-for-darkgate-malware","https://github.com/pr0xylife/DarkGate/tree/main"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Malware/DarkGate/proc_creation_win_malware_darkgate_autoit3_from_susp_parent_and_location.yml","techniques":["T1059"],"cves":[]},{"id":"fb4e2211-6d08-426b-8e6f-0d4a161e3b1d","title":"Clfs.SYS Loaded By Process Located In a Potential Suspicious Location","author":"X__Junior","status":"experimental","level":"medium","date":"2025-01-20","modified":null,"description":"Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.","references":["https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/","https://x.com/Threatlabz/status/1879956781360976155"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.execution","attack.t1059"],"path":"rules/windows/image_load/image_load_clfs_load.yml","techniques":["T1059"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2023-2533","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-20337","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-20281","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-53770","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-47812","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-6554","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-6543","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-33538","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-33053","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-24016","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-32433","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-27038","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-3935","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-35939","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2024-56145","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-4632","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-11182","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-4428","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-4427","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-42999","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-12987","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-32756","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-32709","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-30397","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-32706","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-32701","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-6047","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-3248","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-58136","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-38475","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-31324","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-1976","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-42599","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-3928","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-31201","state":"stale","mapping_types":["secondary_impact"]},{"cveID":"CVE-2025-31200","state":"stale","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-20035","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-53197","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-30406","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-31161","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-22457","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-21590","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-24201","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-24985","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-57968","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-4885","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-43769","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-43939","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-20118","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-34192","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-20953","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-57727","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2024-41710","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-0994","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2020-29574","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-21413","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-23748","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-53104","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-29059","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-45195","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-24085","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-23006","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-50603","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-48365","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-12686","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-5217","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-4879","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-34102","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-20399","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-26169","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-4577","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-4947","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-4761","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-4671","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-20359","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-48788","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-27198","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-43770","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-21887","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-7101","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-36845","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-36846","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-36847","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-36851","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-20273","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-20109","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-22515","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-40044","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-41179","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-3129","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-33246","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-38035","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-26359","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-35081","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-29303","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-20867","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-20887","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-34362","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-2868","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-45046","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-27350","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2017-6742","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-28252","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2022-42948","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-39197","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-35914","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-22952","state":"stale","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-26500","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-26501","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-41125","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2022-36804","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-35405","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-37969","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2022-26258","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-21971","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-34713","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2022-22047","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2010-2883","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2022-22947","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-24521","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-31166","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-22965","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-45382","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-1040","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-21999","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-42237","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-23131","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2020-0787","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-35394","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-22204","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-42321","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-27104","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-27102","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-27101","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2017-9805","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-42013","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-41773","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2016-4437","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2019-17558","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2020-17530","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2017-5638","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2018-11776","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2019-3398","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-26084","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2019-11580","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-42258","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2020-3580","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-1497","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-1498","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2019-13608","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2019-19781","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2019-11634","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2020-29557","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2020-25506","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2017-9822","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2020-8515","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2018-7600","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-22205","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2018-6789","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2020-5902","state":"stale","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-22986","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-35464","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2020-15505","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2017-11882","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-22893","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-22900","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-22894","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2019-11510","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-22005","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-21972","state":"mapped","mapping_types":["primary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}