Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
11
11
4
Contributors
10
3
2
2
1
Categories
18
16
5
4
4
Platforms
24
3
2
1
1
Products / Services
10
7
6
6
1
MITRE Techniques
12
11
7
5
4
CVEs
71
71
64
58
49
26
This rule detects potential exploitation attempts targeting the Windows Server Update Services (WSUS) Remote Code Execution vulnerability, identified as CVE-2025-59287. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected WSUS server.
This rule detects the creation of common Windows command-line interpreters and utilities (cmd.exe, powershell.exe, pwsh.exe, powershell_ise.exe, whoami.exe, net.exe, net1.exe) when initiated by 'w3wp.exe'. The 'w3wp.exe' process is the IIS worker process, and the execution of these utilities from an IIS worker process can be indicative of web shell activity, compromise of the web server, or other malicious activity.
Detects cast exceptions in Windows Server Update Services (WSUS) application logs that highly indicate exploitation attempts of CVE-2025-59287, a deserialization vulnerability in WSUS. The rule specifically looks for `System.InvalidCastException` and `System.Windows.Data.ObjectDataProvider` along with `Unable to cast object of type` and `System.Windows.Media.Brush` within EventID 7053 from the 'Windows Server Update Services' provider.
This query looks for PowerShell launched by WSUS-related processes, especially with encoded or suspicious commands, which aligns with observed exploitation patterns
This rule detects suspicious activity related to Windows Server Update Services (WSUS) that could indicate compromise. It correlates three types of events: 1) external network connections to WSUS ports, 2) modifications to the WSUS log file (SoftwareDistribution.log), and 3) suspicious processes (like cmd.exe, powershell.exe, whoami.exe, net.exe) spawned by WSUS-related processes (w3wp.exe, wsusservice.exe) with specific command-line arguments. The rule aims to identify scenarios where an attacker might be interacting with or manipulating a WSUS server.
Page 2 of 2