Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
2
Contributors
2
2
Categories
3
2
1
1
Platforms
4
Products / Services
2
MITRE Techniques
2
2
2
2
2
CVEs
71
71
64
58
49
Audit CVE Event
Sigma
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Detects events generated by user-mode applications when they call the CveEventWrite API, indicating that a known vulnerability is potentially being exploited. Microsoft started using this log in January 2020, notably with CVE-2020-0601 (a Windows CryptoAPI vulnerability). However, the rule's description notes that this log has historically seen limited use for reporting CVEs.
This rule detects files that exploit CVE-2020-0601, a spoofing vulnerability in Windows CryptoAPI (Crypt32.dll). The rule specifically looks for the presence of a particular Object Identifier (OID) for prime explicit curve parameters and a set of known Elliptic Curve Cryptography (ECC) public keys within a Portable Executable (PE) file that also has a digital signature. This combination of indicators is characteristic of the 'CurveBall' exploit, which leverages the vulnerability to spoof code-signing certificates.
Yara rule that detects CVE-2020-0601 exploit.