Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
Platforms
1
MITRE Techniques
1
1
1
1
CVEs
71
71
64
58
49
This rule detects the creation of a new process where the parent process is 'svchost.exe' with the command line containing '-k RPCSS'. This specific parent process signature is associated with the Remote Procedure Call (RPC) service. The rule aims to identify unusual child processes spawned by the RPC service, which could indicate an exploitation attempt of vulnerabilities like CVE-2022-26809. It's considered a 'long shot' detection, meaning it targets anomalous behavior rather than a direct exploit signature.
