Exploitarium curl SMTP EXPN CRLF Injection PoC Artifact Detection
Detects the presence of specific file artifacts ('VULNERABILITY_CONFIRMED.marker', 'smtp-crlf-injection.curlrc') associated with the 'curl-smtp-expn-recipient-crlf-injection' proof-of-concept repository. The rule also correlates this with the execution of the associated 'run_demo.py' script from directories containing 'curl-smtp', helping identify active use of this testing framework.
Microsoft Sentinel (KQL)
