Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
2
1
1
1
1
Platforms
1
1
1
Products / Services
1
1
1
1
1
MITRE Techniques
2
1
1
1
1
CVEs
71
71
64
58
49
Detects command-line execution (cmd, powershell, bash, curl, etc.) spawned by SmarterMail, Langflow, or Laravel (Livewire) application processes. This pattern is indicative of remote code execution exploitation, such as CVE-2025-52691 (SmarterMail), CVE-2025-34291 (Langflow), or CVE-2025-54068 (Laravel Livewire), often used to download secondary payloads or perform post-exploitation activity.
Detects attempts to exploit the SmarterMail authentication bypass vulnerability (WT-2026-0001) by sending a POST request to the /api/v1/auth/force-reset-password endpoint with 'IsSysAdmin' set to 'true'.
