Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
1
1
1
1
Platforms
2
MITRE Techniques
2
2
1
1
1
CVEs
71
71
64
58
49
Detects the creation of a symbolic link or junction point by a non-elevated process where the target is a critical system file or directory. This is a key step in exploits like CVE-2025-0921, where a privileged process is tricked into writing to a sensitive location by following a malicious link.
Detects modification of critical ICONICS Suite configuration files by unauthorized processes. Attackers can modify these files, such as changing the SMSLogFile path in IcoSetup64.ini, to redirect privileged file writes for privilege escalation or DoS, as seen in the CVE-2025-0921 exploit chain.