Detections · JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

Public CTI triage - JFrog

sigma · Pending service validation

title: Public CTI triage - JFrog
id: 9aca81b7-5261-5665-aff4-3af9eb8e591f
status: experimental
description: Triage observable telemetry associated with the public report keyword.
references:
  - https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json#CVE-2026-66384
logsource:
  category: process_creation
detection:
  selection:
    process.command_line: 'JFrog'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity
level: medium

SPL triage - JFrog

spl · validation unavailable

index=* (CommandLine="*JFrog*")

KQL triage - JFrog

kql · validation unavailable

DeviceProcessEvents | where ProcessCommandLine contains "JFrog"