Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
3
2
2
1
1
Platforms
3
2
2
Products / Services
3
MITRE Techniques
2
2
1
1
1
CVEs
71
71
64
58
49
Detects inbound exploitation attempts and subsequent outbound payload fetching associated with Metro4Shell (CVE-2025-11953) indicators of compromise, including known malicious source IPs and payload hosting endpoints.
Detects potential exploitation of CVE-2025-11953 (Metro4Shell) where a Node.js development server spawns a command shell executing an encoded PowerShell command. The PowerShell script performs defense evasion via Windows Defender exclusions (Add-MpPreference), downloads a payload over raw TCP sockets (System.Net.Sockets.TcpClient), and executes it using Start-Process.
Detects inbound exploitation attempts and subsequent outbound payload fetching associated with Metro4Shell (CVE-2025-11953) indicators of compromise, including known malicious source IPs and payload hosting endpoints.