Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
2
Contributors
2
1
1
Categories
3
2
2
1
1
Platforms
3
1
Products / Services
2
1
1
1
MITRE Techniques
3
3
2
2
2
CVEs
71
71
64
58
49
Detects a specific persistence mechanism where a scheduled task named 'TPMProfiler' is used to run QEMU, establishing an SSH backdoor. This technique was identified by Huntress in post-exploitation activity related to SolarWinds WHD exploitation.
Detects attempts to exploit a deserialization vulnerability (CVE-2025-40553) in SolarWinds Web Help Desk. Attackers use non-standard hex escape sequences (e.g., `\xNN`) in JSON payloads to bypass security filters and achieve remote code execution.
Detects the SolarWinds Web Help Desk service process (java.exe) launching shell or installer processes to download payloads from suspicious domains. This behavior is consistent with the exploitation of CVE-2025-26399 as reported by Huntress.
This rule detects the execution of msiexec.exe from cmd.exe with command-line arguments indicating a silent installation of a remote MSI package over HTTP or HTTPS. This behavior is indicative of post-exploitation activity, specifically observed in the context of SolarWinds Web Help Desk (WHD) exploitation where attackers use msiexec to download and install malicious payloads.
