Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
3
1
Contributors
3
1
Categories
3
2
1
1
1
Platforms
4
2
Products / Services
2
2
1
1
1
MITRE Techniques
2
1
1
1
1
CVEs
71
71
64
58
49
Detects instances where the Windchill Java/Tomcat application server process spawns command-line interfaces such as cmd.exe, powershell.exe, or bash.exe. This activity is indicative of post-exploitation behavior associated with CVE-2026-12569, where an attacker exploits a deserialization vulnerability to execute arbitrary commands, often for the purpose of dropping web shells.
Detects unauthorized POST requests to the '/Windchill/login/' directory targeting .jsp files. This path is not used by legitimate PTC Windchill/FlexPLM traffic and is indicative of an adversary attempting to interact with a webshell or exploit a vulnerability such as CVE-2026-12569.
Detects exploitation of the CVE-2026-12569 Java deserialization vulnerability in PTC Windchill and FlexPLM. The detection triggers when the specific payload class 'com.ptc.wpcfg.logic.ExpressionClassMethod' is identified within command-line arguments of Java-based processes, indicating an attempt to achieve remote code execution through the application's deserialization flaw.
Detects potential Cl0p ransomware activity by correlating the deletion of Volume Shadow Copies or backup catalogs with a subsequent burst of file creation, modification, or renaming activity on the same device. This behavior is indicative of ransomware preparing to encrypt files by inhibiting system recovery, followed by the mass encryption stage, while filtering out known administrative and legitimate software update activity.