Detections

title: Public CTI triage - Known
id: 833d1955-02ab-50b1-8d83-967d345c8047
status: experimental
description: Triage observable telemetry associated with the public report keyword.
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
detection:
  selection:
    process.command_line: 'Known'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity
level: medium

index=* (CommandLine="*Known*")

DeviceProcessEvents | where ProcessCommandLine contains "Known"