Detections

title: Public CTI triage - ownCloud
id: 5246c2d4-0723-5195-b129-bf9976c37c16
status: experimental
description: Triage observable telemetry associated with the public report keyword.
references:
  - https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json#CVE-2023-49105
logsource:
  category: process_creation
detection:
  selection:
    process.command_line: 'ownCloud'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity
level: medium

index=* (CommandLine="*ownCloud*")

DeviceProcessEvents | where ProcessCommandLine contains "ownCloud"