Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
1
1
1
1
Platforms
2
Products / Services
1
1
1
1
MITRE Techniques
1
1
1
1
1
CVEs
71
71
64
58
49
KQL Query
Detects potential exploitation of Cisco SNMP vulnerability (CVE-2025-20352) by identifying shell command patterns within SNMP traffic, indicative of remote code execution attempts as seen in Operation Zero Disco.
This rule identifies Cisco network devices within Microsoft Defender for Endpoint (MDE) telemetry that are running Cisco IOS or Cisco XE operating systems, excluding version '17.15.4a'. The exclusion of a specific OS version suggests the rule is designed to pinpoint devices that may be vulnerable to a known security flaw, potentially CVE-2025-20352 as indicated by the rule's title. It helps in mapping exposure to specific vulnerabilities by identifying potentially unpatched or vulnerable network infrastructure components.