Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
1
1
1
1
1
Platforms
2
1
1
1
Products / Services
1
1
MITRE Techniques
1
1
CVEs
71
71
64
58
49
Identifies deployments of Gotenberg vulnerable to CVE-2026-42589 across multiple Microsoft Defender telemetry sources including TVM inventory, vulnerabilities, container images, listening services, and binaries on disk.
Detects command output staged in a temporary file (/tmp/nx_cmd.txt) by a Unix shell spawned from ExifTool or Perl, typically resulting from Gotenberg CVE-2026-42589 exploitation, or detects the specific staging filename behavior independently.