Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
3
1
Platforms
3
Products / Services
1
1
MITRE Techniques
1
1
1
1
1
CVEs
71
71
64
58
49
Detects the creation of suspicious processes (like command interpreters or scripting engines) as child processes of the Serv-U.exe application. This pattern is indicative of potential exploitation of the Serv-U service, possibly through vulnerabilities like CVE-2021-35211, leading to arbitrary command execution.
Detects patterns indicative of the exploitation of the Serv-U CVE-2021-35211 vulnerability, specifically looking for the execution of 'whoami' in conjunction with specific file paths related to the Serv-U client. This activity has been associated with the threat group DEV-0322.
Detects a suspicious process pattern which could be a sign of an exploited Serv-U service