Exploitarium Pillow ImageCms OOB Write PoC Execution (pillow-imagecms-output-mode-oob-poc)
Detects the execution of Python-based proof-of-concept scripts related to the Pillow ImageCms out-of-bounds write vulnerability. The rule monitors for Python process execution involving specific file paths associated with the PoC, and correlates this with subsequent process crashes or abort signals which are indicative of an exploit attempt resulting in process instability.
Microsoft Sentinel (KQL)
