Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Platforms
1
Products / Services
1
CVEs
71
71
64
58
49
IDS Protocols
1
This query provides high-fidelity, post-exploitation hunting for CVE-2026-69730 by catching unauthorized child processes spawned from the Windows DNS Server engine (dns.exe).
Because dns.exe runs natively as NT AUTHORITY\SYSTEM and almost never executes external binaries during normal operations, filtering out known OS noise (conhost.exe and werfault.exe) flags potential RCE breakouts and privilege escalation with near-zero false positives.
Because dns.exe runs natively as NT AUTHORITY\SYSTEM and almost never executes external binaries during normal operations, filtering out known OS noise (conhost.exe and werfault.exe) flags potential RCE breakouts and privilege escalation with near-zero false positives.
