Every published rule

Windows Exchange UMWorkerProcess File Drops Indicating CVE-2021-26858 Exploitation

Alerts on Exchange Unified Messaging (UMWorkerProcess.exe) creating unusual files, excluding common benign names consistent with CVE-2021-26858 activity.

Windows Process Creation: Suspected CVE-2021-26857 Exploitation via UMWorkerProcess.exe

Detects suspicious child process spawning by Exchange Unified Messaging (UMWorkerProcess.exe) associated with CVE-2021-26857 attempts.

Windows Process Creation: finger.exe Execution

Alerts on Windows executions of finger.exe, a legacy utility that may indicate suspicious reconnaissance or network activity.

Webserver POST to vROps uploadova endpoint indicative of CVE-2021-21972 exploitation

Alerts on POST requests to the uploadova endpoint tied to CVE-2021-21972 vSphere exploitation.

Webserver URI Detects DEWMODE Webshell Access Attempts

Identifies webserver requests with DEWMODE webshell-specific URI query parameter patterns.

Windows Process Creation: logman.exe Used to Stop or Delete ETW Trace Sessions

Alerts when logman.exe is used to stop or delete Windows ETW trace sessions.

Windows Process Creation: AdFind Executed with Suspicious Recon Flags

Detects AdFind executions on Windows that include common AD reconnaissance parameters.

Windows Audit Policy Tampering Using auditpol.exe Command-Line Flags

Flags auditpol.exe executions that disable, clear, remove, or restore Windows audit policy settings.

Windows Process Creation: Detect ShimCache Flush via rundll32 apphelp.dll/kernel32.dll

Flags rundll32 command-line activity that flushes ShimCache via apphelp.dll or kernel32.dll entry points.

Windows rundll32.exe execution with no parameters or arguments

Alerts on Windows rundll32.exe being started with an empty/no-parameter command line.

Windows WMIC Uninstall/Terminate Actions Targeting Security Products

Flags WMIC commands on Windows that attempt to uninstall or terminate security products or sensors using known vendor/product strings.

Windows Command-Line Disables Volume Shadow Copy (VSS) Snapshots

Flags Windows command lines that disable Volume Shadow Copy (VSS) snapshots via VSS Diag service switches.

Webserver Detection: SonicWall SSL VPN Jarrewrite Exploitation URI and User-Agent Payloads

Flags web requests to /cgi-bin/jarrewrite.sh with user-agent indicators consistent with command injection exploitation.

Webserver detection of TerraMaster TOS CVE-2020-28188 exploit requests

Flags GET requests to /include/makecvs.php with Event plus indicators of script download/execute behavior tied to CVE-2020-28188.

Windows Process Creation: 7z Archive Creation with Script/Command Launch Chaining

Flags Windows process creation chaining 7z archive commands with .zip plus .txt/.log extensions and wscript+rundll32 context.

Windows Process Creation: Raccine Removal via taskkill, registry and scheduled task deletion

Detects command-line activity that stops and removes Raccine components through process killing, registry deletion, and scheduled task removal.

Windows Service Installation (EID 4697) for SMB PsExec by Metasploit or Impacket

Alerts on Windows Event ID 4697 service installs matching SYSTEMROOT\8char.exe and on-demand start, consistent with PsExec-style SMB execution.

Windows Plink Remote Port Forwarding via -R Command Line

Alerts on Windows process command lines using Plink " -R " remote port forwarding to a local port.

Windows System Log: NTFS File System Driver Event 55 Indicates Possible NTFS Exploitation

Alerts on Windows NTFS Event ID 55 indicating a corrupted file record with a matching filename string in the event description.

Cisco ASA FTD web exploitation attempt matching CVE-2020-3452 with HTTP 200

Detects HTTP 200 requests targeting Cisco ASA/FTD web parameters associated with CVE-2020-3452 exploit behavior.