Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
1
1
Platforms
2
Products / Services
1
MITRE Techniques
2
1
1
1
1
CVEs
71
71
64
58
49
Detects abnormal child process creation from msdt.exe, diaghub.exe, diagtrack.exe, winword.exe, excel.exe, or outlook.exe. The child processes of interest include common scripting and system utilities such as cmd.exe, powershell.exe, mshta.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, schtasks.exe, at.exe, net.exe, and net1.exe. This activity is commonly associated with Office/browser exploitation chains, specifically linked to APT28 exploiting CVE-2026-21509 and CVE-2026-21513 in Microsoft products.
This detection helps you spot activity linked to Pawn Storm PRISMEX (CVE-2026-21509 / CVE-2026-21513) using the specific indicators in the linked source. It is written to be high confidence by focusing on exact versions, domains, paths, or file fingerprints that were observed in the reporting. A match does not prove a system is compromised by itself, but it is a strong reason to investigate. Confirm the affected host and user, check whether the access was expected, and review nearby activity for follow-on steps like additional downloads, new persistence, or repeated connections. Use the source link to support incident notes and.
