Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
21 detections
Filters
Last updated
All Time
Detection languages
18
2
1
Contributors
11
6
2
1
1
Categories
10
8
6
6
4
Platforms
12
9
3
Products / Services
6
5
3
2
1
MITRE Techniques
11
10
7
6
6
CVEs
71
71
64
58
49
21
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
Detects alerts that reference specific CVEs historically exploited by the threat group QTFY against internet-facing applications, including common vulnerabilities in Pulse Secure, FortiOS, Citrix ADC, Exchange, F5 BIG-IP, Log4Shell, and others, when the alert severity is Medium or High and contains indicators of exploit or initial access.
This rule detects potential exploitation attempts targeting the BeyondTrust Privileged Remote Access API by identifying unauthenticated POST requests directed at specific sensitive API endpoints (e.g., /api/, /remote-support/). It flags high-frequency or multi-path request patterns indicative of automated vulnerability scanning or exploitation attempts related to CVE-2026-1731, where the absence of authorization headers is a key indicator of unauthorized access.
This rule detects potential exploitation attempts targeting the BeyondTrust Privileged Remote Access API by identifying unauthenticated POST requests directed at specific sensitive API endpoints (e.g., /api/, /remote-support/). It flags high-frequency or multi-path request patterns indicative of automated vulnerability scanning or exploitation attempts related to CVE-2026-1731, where the absence of authorization headers is a key indicator of unauthorized access.
This rule detects suspicious post-exploitation activity originating from the BeyondTrust/Bomgar session process, `bomgar-scc.exe`. It identifies the execution of common Windows command-line interpreters and scripting environments (`cmd.exe`, `powershell.exe`, `pwsh.exe`, etc.) or the presence of specific command-line substrings indicative of privilege escalation, credential access, reconnaissance, lateral movement, defense evasion (like log clearing), or download/execution cradles. The rule assigns a risk score based on the detected activities and triggers an alert if the cumulative score and unique child process count exceed predefined thresholds, suggesting a high-confidence post-exploitation scenario.
This rule detects suspicious child processes spawned by the BeyondTrust Remote Support client (bomgar-scc), which could indicate post-exploitation activity following a compromise via vulnerabilities like CVE-2026-1731. It looks for high-risk command line patterns and suspicious child processes commonly used for reconnaissance and payload execution.
This rule detects files by their SHA256 hash that are known to be associated with the exploitation of CVE-2026-1731. This includes payloads such as SparkRAT, VShell, and various web shells and droppers.
This rule detects the execution of PHP with command-line arguments indicative of web shells like 'aws.php' and 'file_save.php', which have been used in the exploitation of CVE-2026-1731. The detection looks for the use of eval with base64 decoding and specific, non-standard parameters used to pass commands.
This rule detects PowerShell commands used to encode data (like hostnames) into hexadecimal strings and exfiltrate it via DNS queries to known Out-of-Band Application Security Testing (OAST) domains. This technique is used by attackers to bypass egress filtering and confirm system compromise, as seen in the exploitation of CVE-2026-1731.
Detects execution of net.exe/net1.exe to create a new domain account, potentially initiated by a compromised BeyondTrust/Bomgar process.
Detects when the BeyondTrust remote support client process ('bomgar-scc.exe' or 'bomgar-scc') spawns a shell or a common reconnaissance/downloader tool. This behavior is a strong indicator of post-exploitation activity related to vulnerabilities like CVE-2026-1731, where an attacker gains code execution and begins to explore the compromised system.
Detects DNS queries to known OAST (Out-of-Band Application Security Testing) domains like oastify.com, oast.pro, and oast.fun where the subdomain is unusually long (over 50 characters). Long subdomains may indicate encoded data exfiltration, a technique observed in the exploitation of vulnerabilities like CVE-2026-1731 to bypass egress filtering.
Detects the creation of files matching SHA256 hashes of known malware (SparkRAT, VShell, webshells) observed in the CVE-2026-1731 exploitation campaign. This rule specifically looks for file creation events where the SHA256 hash of the created file matches one of the predefined malware hashes.
Detects the use of a specific PowerShell command pattern using the '[adsiSearcher]' type accelerator to enumerate and count computer objects in Active Directory. This technique was observed being used for discovery in campaigns following the exploitation of CVE-2026-1731 (BeyondTrust).
Detects a BeyondTrust (Bomgar) process spawning shell or system administration child processes. This activity is highly indicative of OS command injection, potentially related to the exploitation of CVE-2026-1731.
Detects the use of the 'net' command to create a new domain user and immediately add that user to a high-privilege domain group (e.g., Enterprise Admins, Domain Admins) within a short time window. This TTP was observed in campaigns following the exploitation of BeyondTrust (CVE-2026-1731) to establish persistent, privileged access.
Detects the creation or execution of files, often in C:\ProgramData, with a file description of 'SimpleHelp Remote Access Client' but using non-standard or renamed filenames. This is indicative of threat actors deploying the SimpleHelp RMM tool for persistence, as observed in campaigns exploiting CVE-2026-1731 in BeyondTrust.