Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
CVEs
71
71
64
58
49
Detects potentially suspicious child processes spawned by the SSH daemon (sshd) that execute commands using 'bash -c' or 'sh -c' as the root user. This behavior is indicative of potential exploitation of CVE-2024-3094, a backdoor in the XZ Utils library.
