Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
2
2
2
1
Platforms
2
1
Products / Services
1
1
1
1
1
MITRE Techniques
2
2
1
1
1
CVEs
71
71
64
58
49
Detects command-line execution (cmd, powershell, bash, curl, etc.) spawned by SmarterMail, Langflow, or Laravel (Livewire) application processes. This pattern is indicative of remote code execution exploitation, such as CVE-2025-52691 (SmarterMail), CVE-2025-34291 (Langflow), or CVE-2025-54068 (Laravel Livewire), often used to download secondary payloads or perform post-exploitation activity.
This rule detects suspicious activity involving multiple POST requests to Livewire update endpoints on web servers, followed by the spawning of unusual processes from web server parent processes (php, apache, httpd, nginx, php-fpm). The spawned processes of interest include various shells (sh, bash), command-line tools (curl, wget, python, perl, nc), or commands containing base64 encoding, chmod +x, or /tmp/ paths. This behavior could indicate a web shell compromise or successful exploitation leading to command execution.
