CVE Exploitarium: curl SMTP EXPN/VRFY CRLF Injection Attempt
Detects the execution of the 'curl' utility with parameters configured to interact with an SMTP server using 'EXPN' or 'VRFY' commands while loading a configuration file via the '-K' flag. This pattern is indicative of an attempt to exploit CVEs or software vulnerabilities that are susceptible to CRLF injection within SMTP recipient fields, potentially leading to unauthorized mail relaying or protocol manipulation.
Microsoft Sentinel (KQL)
