Detections

title: Public CTI triage - Three
id: e2a5af90-05b3-50d1-9fb6-d70a912676ae
status: experimental
description: Triage observable telemetry associated with the public report keyword.
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/27/cisa-adds-three-known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
detection:
  selection:
    process.command_line: 'Three'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity
level: medium

index=* (CommandLine="*Three*")

DeviceProcessEvents | where ProcessCommandLine contains "Three"