Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
29 detections
Filters
Last updated
All Time
Detection languages
15
8
3
2
1
Contributors
7
5
5
4
2
Categories
19
12
7
4
4
Platforms
14
7
7
5
4
Products / Services
6
5
5
5
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
2
2
1
1
IDS Classtypes
2
IDS Protocols
2
This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls.
This query detects possible abuse of ms-msdt MSProtocol URI scheme to load and execute malicious code via Microsoft Support Diagnostic Tool Vulnerability (CVE-2022-30190).
The following query detects when Microsoft Office software spawns an instance of the MSDT utility, msdt.exe.
References:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
https://attack.mitre.org/techniques/T1221/
The following query detects when Microsoft Office software spawns an instance of the MSDT utility, msdt.exe.
References:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
https://attack.mitre.org/techniques/T1221/
Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.
The analytic detects server-side template injection attempts related to CVE-2022-22954 in VMware Workspace ONE. It identifies HTTP GET requests to the endpoint */catalog-portal/ui/oauth/verify* containing the string "freemarker.template.utility.Execute". This activity indicates potential exploitation attempts that could lead to remote code execution, full system compromise, data exfiltration, or lateral movement.
The following analytic identifies attempts to exploit a critical template injection vulnerability (CVE-2023-22527) in outdated Confluence Data Center and Server versions. It detects POST requests to the "/template/aui/text-inline.vm" endpoint with HTTP status codes 200 or 202, indicating potential OGNL injection attacks. This activity is significant as it allows unauthenticated attackers to execute arbitrary code remotely. If confirmed malicious, attackers could gain full control over the affected Confluence instance, leading to data breaches, system compromise, and further network infiltration. Immediate patching is essential to mitigate this threat.
Detects modifications to the 'ms-msdt' URI scheme in the Windows Registry, specifically when the 'TargetObject' starts with 'HKCR\ms-msdt\'. This activity could indicate an attempt to exploit CVE-2022-30190, a Microsoft Support Diagnostic Tool (MSDT) vulnerability, often referred to as "Follina". The vulnerability allows for remote code execution via specially crafted Microsoft Office documents.
Detects exceptions in the Velocity template renderer, which likely indicates dynamic rendering of user-controlled input. This vulnerability, known as Server-Side Template Injection (SSTI), can lead to Remote Code Execution (RCE) if successfully exploited.
Detects Server-Side Template Injection (SSTI) attempts made via GET requests. The rule looks for common SSTI payload strings within the request, specifically excluding requests that result in a 404 Not Found status code to reduce false positives.
Page 2 of 2