Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
2
1
1
1
Platforms
1
1
Products / Services
2
1
1
1
1
MITRE Techniques
2
2
1
1
1
CVEs
71
71
64
58
49
IDS Classtypes
1
IDS Protocols
1
Detects suspicious child process creation originating from Adobe ColdFusion or IIS worker processes (w3wp.exe). This rule monitors for the execution of command-line shells, scripting engines, or download utilities often used in exploitation of vulnerabilities like CVE-2023-26360, CVE-2023-29298, or CVE-2023-29300.
ET WEB_SPECIFIC_APPS Adobe ColdFusion Unauthenticated Remote Code Execution (CVE-2023-29300)
