Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
1
1
Platforms
1
1
Products / Services
1
1
MITRE Techniques
1
1
1
CVEs
71
71
64
58
49
Detects potential exploitation of ImageMagick vulnerabilities where Ghostscript delegates are used to achieve arbitrary code execution. The rule monitors for suspicious Ghostscript command-line arguments (e.g., missing or disabled -dSAFER), child process creation (spawning shells or interpreters), execution of network tools, unauthorized file modifications with script/binary extensions, and outbound network connections initiated by Ghostscript processes.
