Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
2
1
Categories
3
2
2
1
Platforms
2
2
Products / Services
2
1
1
1
1
MITRE Techniques
3
3
2
2
2
CVEs
71
71
64
58
49
This rule detects post-exploitation activity on Microsoft Exchange Servers by monitoring for w3wp.exe (IIS worker process) spawning command-line interpreters such as cmd.exe, powershell.exe, or pwsh.exe. This behavior is indicative of an attacker leveraging a web shell, often deployed via the exploitation of vulnerabilities like ProxyLogon (CVE-2021-26855), ProxyNotShell (CVE-2022-41082), or similar remote code execution flaws targeting Exchange endpoints.
Detects anomalous child process creation from typical web and application server processes (IIS w3wp.exe or Openfire Java processes). This behavior is consistent with post-exploitation activity following web application vulnerability exploitation, specifically web shell deployment and execution of reconnaissance or secondary payload staging commands.
Detects an attempt to leverage the vulnerable servlet "mboximport" for an unauthenticated remote command injection in Zimbra Collaboration Suite Email Server, specifically targeting CVE-2022-27925. The rule looks for POST requests to the '/service/extension/backup/mboximport' endpoint with specific query parameters ('account-name', 'ow', 'no-switch', 'append') and then checks for subsequent requests to '/zimbraAdmin/*.jsp' with a 200 status code, indicating potential successful exploitation and web shell access.
