Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
1
CVEs
71
71
64
58
49
Detects post-exploitation indicators of CVE-2026-62911, an authentication-bypass-by-capture-replay vulnerability in Microsoft Exchange. The rule identifies anomalous behavior following a potential bypass: either the assignment of the ApplicationImpersonation management role or a single impersonation session accessing an abnormally high number of distinct mailboxes (FolderBind, MessageBind, or SendAs).
https://www.bleepingcomputer.com/news/security/nearly-22-000-microsoft-exchange-servers-vulnerable-to-hijack-attacks/
