Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
2
Contributors
3
2
Categories
5
4
4
2
1
Platforms
5
Products / Services
2
MITRE Techniques
4
4
3
2
2
CVEs
71
71
64
58
49
Detects instances where the telnetd process spawns the login binary with the '-f' flag. This behavior is indicative of exploitation of CVE-2026-24061, which allows an attacker to bypass authentication by injecting arguments into the login process via a crafted USER environment variable.
Detects exploitation of CVE-2026-24061, an authentication bypass in GNU telnetd, where the 'login' process is spawned with the '-f' flag to skip authentication and gain root access.
Detects the telnetd process spawning child processes with highly suspicious environment variables, such as a modified PATH or LD_PRELOAD. This can indicate an attempt to hijack execution or move laterally, and is a technique associated with CVE-2026-24061.
Detects the exploitation of CVE-2026-24061, a critical authentication bypass vulnerability in GNU telnetd. The rule identifies when the 'telnetd' process spawns '/usr/bin/login' with the '-f' flag, which skips authentication and grants the attacker remote access.
Detects the execution of the 'login' process with the '-f' flag, which skips authentication. When spawned by 'telnetd', this is a strong indicator of exploitation of CVE-2026-24061, a critical authentication bypass vulnerability.