Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
4
1
Contributors
2
2
1
Categories
2
2
1
1
1
Platforms
3
2
Products / Services
1
1
1
1
MITRE Techniques
2
2
2
2
2
CVEs
71
71
64
58
49
Detects evidence of exploitation and post-exploitation activity related to CVE-2026-59310, an unauthenticated RCE vulnerability in the VMware vCenter Syslog Server. The rule monitors for suspicious child processes spawned by vmsyslogcollector, directory traversal patterns in command lines, and persistence mechanisms involving SSH authorized_keys modification, cron job creation, or systemd unit deployment on the VCSA shell.
The detection monitors for the creation or modification of the suspicious systemd service file network-manager.service under /etc/systemd/system/, as well as attempts to enable, start, or restart the service using systemctl.
Identifies the creation or modification of files within /etc/cron.d that exhibit suspicious naming conventions, including references to syslog, .log extensions, 59310, or known filenames such as zz-poc59310-syslog.log. The rule is intended to detect potential abuse of the cron scheduling mechanism for persistence, particularly where attackers disguise cron entries as legitimate log files to evade detection.
Detects creation of new scheduled tasks (cron), systemd services, or startup entries that reference the reverse_ssh tool, consistent with attacker persistence established after vCenter compromise.
Detects execution of a process matching the reverse_ssh client naming pattern followed by an outbound network connection, consistent with the open-source reverse_ssh tool establishing an outbound reverse SSH tunnel for C2/remote access.