objdump DLX/calc PoC Execution from exploitarium (objdump-dlx-calc-poc)
This rule detects activities related to the 'Exploitarium' DLX exploit proof-of-concept (PoC) toolkit. It monitors for the invocation of 'objdump' with specific flags used in these exploits, the presence of associated Python and shell scripts on the filesystem, and the spawning of suspicious child processes (like command interpreters or calculators) by 'objdump', which acts as an indicator of successful exploitation or exploit testing.
Microsoft Sentinel (KQL)
