Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
3
2
Platforms
3
Products / Services
3
MITRE Techniques
3
3
CVEs
71
71
64
58
49
Detects suspicious process executions where Sysmon itself is the parent of a newly created process. This behavior can indicate an exploitation attempt, such as the one described in CVE-2022-41120, where an attacker might leverage a vulnerability in Sysmon to execute arbitrary code with elevated privileges. The rule filters out legitimate Sysmon processes and known system processes that might legitimately be children of Sysmon.
Detects the execution of a Proof-of-Concept (PoC) tool named 'SysmonEOP.exe' or a variant identified by specific IMPHASH values. This tool is designed to exploit CVE-2022-41120, a vulnerability in Sysmon that can lead to privilege escalation.
Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120