Swachchhanda Shrawan Poudel 8721fa654c Merge PR #5479 from @swachchhanda000 - Webdav CVE-2025-33053 RCE vulnerability ...

new: Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load
new: Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access
new: Potential Exploitation of RCE Vulnerability CVE-2025-33053

---------

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

2025-06-13 13:30:14 +02:00

..

proc_creation_win_7zip_password_extraction.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_attrib_system.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_boinc_execution.yml

Merge PR #5473 from @frack113 - chore: add ET and TH tags

2025-06-12 10:21:24 +02:00

proc_creation_win_cmd_redirect.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_cmd_set_prompt_abuse.yml

Merge PR #4969 from @Mahir-Ali-khan - Add Potential File Override/Append Via SET Command

2024-08-22 23:31:52 +02:00

proc_creation_win_conhost_headless_execution.yml

Merge PR #5473 from @frack113 - chore: add ET and TH tags

2025-06-12 10:21:24 +02:00

proc_creation_win_csc_compilation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_curl_download.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_curl_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_curl_fileupload.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_curl_useragent.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_dfsvc_child_processes.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_diskshadow_child_process.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_diskshadow_script_mode.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_explorer_child_of_shell_process.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_extexport_execution.yml

Merge PR #4937 from @nasbench - Multiple updates and fixes

2024-08-29 14:43:32 +02:00

proc_creation_win_findstr_password_recon.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_iexpress_execution.yml

Merge PR #5101 from @nasbench - Promote older rules status from experimental to test

2024-12-01 13:40:32 +01:00

proc_creation_win_microsoft_workflow_compiler_execution.yml

Merge PR #4937 from @nasbench - Multiple updates and fixes

2024-08-29 14:43:32 +02:00

proc_creation_win_mode_codepage_change.yml

Merge PR #5101 from @nasbench - Promote older rules status from experimental to test

2024-12-01 13:40:32 +01:00

proc_creation_win_net_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_net_quic.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_office_svchost_parent.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_powershell_abnormal_commandline_size.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_powershell_crypto_namespace.yml

Merge PR #5027 from @nasbench - Promote older rules status from experimental to test

2024-10-01 14:56:09 +02:00

proc_creation_win_powershell_import_module.yml

Merge PR #5027 from @nasbench - Promote older rules status from experimental to test

2024-10-01 14:56:09 +02:00

proc_creation_win_powershell_new_netfirewallrule_allow.yml

Merge PR #5473 from @frack113 - chore: add ET and TH tags

2025-06-12 10:21:24 +02:00

proc_creation_win_powershell_susp_child_processes.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_regsvr32_dllregisterserver_exec.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

proc_creation_win_remote_access_tools_action1_code_exec_and_remote_sessions.yml

Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002

2025-06-13 10:00:52 +02:00

proc_creation_win_remote_access_tools_ammyy_admin_execution.yml

Merge PR #5448 from @nasbench - Promote older rules status from experimental to test

2025-06-02 13:29:48 +02:00

proc_creation_win_remote_access_tools_anyviewer_shell_exec.yml

Merge PR #5448 from @nasbench - Promote older rules status from experimental to test

2025-06-02 13:29:48 +02:00

proc_creation_win_remote_access_tools_screenconnect_child_proc.yml

Merge PR #5149 from @nasbench - Promote older rules status from experimental to test

2025-01-06 15:36:19 +01:00

proc_creation_win_rundll32_by_ordinal.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_rundll32_dllregisterserver.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

proc_creation_win_sc_query.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_schtasks_creation_from_susp_parent.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_susp_cli_obfuscation_unicode.yml

Merge PR #5002 from @secDre4mer - Update Potential CommandLine Obfuscation Using Unicode Characters rules

2024-09-06 11:42:04 +02:00

proc_creation_win_susp_compression_params.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_susp_elevated_system_shell.yml

Merge PR #5224 from @swachchhanda000 - Fix Multiple FPs

2025-04-07 11:05:53 +02:00

proc_creation_win_susp_event_log_query.yml

Merge PR #5101 from @nasbench - Promote older rules status from experimental to test

2024-12-01 13:40:32 +01:00

proc_creation_win_susp_execution_from_guid_folder_names.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_susp_execution_path_webserver.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_susp_exfil_and_tunneling_tool_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_susp_file_permission_modifications.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_susp_script_exec_from_compressed_parent.yml

Merge PR #4961 from @tsale - Add multiples rules and updates

2024-08-29 19:21:47 +02:00

proc_creation_win_taskkill_execution.yml

Merge PR #5033 from @MalGamy12 - Update Process Terminated Via Taskkill

2024-10-06 22:34:21 +02:00

proc_creation_win_tasklist_basic_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_webdav_process_execution.yml

Merge PR #5479 from @swachchhanda000 - Webdav CVE-2025-33053 RCE vulnerability

2025-06-13 13:30:14 +02:00

proc_creation_win_wmic_recon_system_info.yml

Merge PR #5101 from @nasbench - Promote older rules status from experimental to test

2024-12-01 13:40:32 +01:00

proc_creation_win_wscript_cscript_script_exec.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_win_wsl_arbitrary_command_execution.yml

Merge PR #4937 from @nasbench - Multiple updates and fixes

2024-08-29 14:43:32 +02:00

proc_creation_win_wusa_cab_files_extraction.yml

Merge PR #4937 from @nasbench - Multiple updates and fixes

2024-08-29 14:43:32 +02:00