Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
1
1
1
1
1
Platforms
3
Products / Services
2
1
1
MITRE Techniques
1
1
1
1
1
CVEs
71
71
64
58
49
This rule detects the creation or modification of specific SharePoint policy pages DLL files (microsoft.office.policy.pages.dll) that are known to be vulnerable to CVE-2026-45454. The detection is based on matching the SHA256 hashes of these vulnerable DLL versions. This indicates the presence or manipulation of a vulnerable component within a SharePoint environment.
This rule detects the creation of common reconnaissance and shell utilities (whoami.exe, hostname.exe, ipconfig.exe, cmd.exe, powershell.exe) by the IIS worker process (w3wp.exe) on Windows systems. This activity is often indicative of a web application compromise, such as a SharePoint vulnerability (e.g., path traversal), where an attacker leverages the web server to execute system commands for discovery or further exploitation. The rule specifically targets Security Event ID 4688 (process creation) and filters for processes spawned by w3wp.exe.
Detects attempts to exploit a path traversal vulnerability in SharePoint's Upload.aspx page by looking for requests to 'Upload.aspx' that include both 'List=' and 'RootFolder=' parameters, specifically targeting sensitive catalogs like '_catalogs'. This indicates an attempt to upload files to unauthorized locations.