Exploitarium-Detections

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-ETHAN-ANDREWS-EXPLOITARIUM-DETECTIONS
# Exploitarium KQL Detection Coverage

KQL detection rules for Microsoft Sentinel and Defender XDR covering the **bikini/exploitarium** anonymous disclosure — a personal research archive of 15+ distinct vulnerability targets across 109+ tracked files, released without vendor notification on June 23, 2026.

**54 rules** | **23 product folders** | **KQL** | **Author:** Ethan Andrews (@eandrews)

Last Updated: 7/1/2026

Intel report: https://systemtwosecurity.com/share/inspiration/VNJMKFVM

* * *

## Background

An anonymous researcher known as 'bikini' released exploitarium, a GitHub repo containing proof-of-concept research across 15+ distinct vulnerability targets (109+ tracked files across 15+ folders). The repo is actively updated — new entries are being added as the researcher continues publishing work.

**Scope clarification:** The repo contains 15 distinct vulnerability research targets. File counts per folder reflect individual files (scripts, payloads, helpers, READMEs) — not distinct CVEs. The researcher's README notes these were unreported at time of posting and explicitly invites others to file CVEs.

The most technically significant findings — libssh2 pre-auth heap write and Gitea default Docker auth bypass — have been independently verified as high-risk with active exploitation observed. Some entries have been dismissed by the community as low-impact noise.

* * *

## Exploitarium Folder Breakdown

* * *

## Repository Structure

root@kitploit:~
    
    
    Exploitarium-Detections/
    ├── 7zip/                 # MOTW bypass x3 (rules 02, 27, 28)
    ├── anydesk/              # COM hijack DLL, named pipe, PE fingerprint recon (rules 06, 17, 36)
    ├── c-ares/               # TCP UAF NDR sequence, linkage recon, DNS failure spike (rules 07, 08, 41)
    ├── curl/                 # SMTP CRLF injection attempt + PoC artifact (rules 45, 46)
    ├── docker/               # Privileged container host mount shell spawn (rule 38)
    ├── exploitarium-generic/ # calc.exe PoC generic, multi-CVE sweep (rules 22, 44)
    ├── ffmpeg/               # (reserved)
    ├── firefox/              # SmartWindow silent enablement (rule 09)
    ├── flowise/              # Unauthorized API access (rule 37)
    ├── ghidra/               # Headless analyzer suspicious script execution (rule 40)
    ├── imagemagick/          # Policy bypass delegate execution (rule 39)
    ├── libarchive/           # ZIP debuginfod size boundary bypass x2 (rules 51, 52)
    ├── libssh2/              # Pre-auth RCE, DoS x2, scaffold x2, heap corruption, recon (rules 01, 12, 13, 24, 25, 26, 35)
    ├── lunar-client/         # Electron IPC preload, Modrinth gameDirectory abuse (rules 15, 16)
    ├── mybb/                 # ACP privilege escalation x2 (rules 05, 21)
    ├── nextjs/               # unstable_cache PoC execution, cache object collision (rules 49, 50)
    ├── nmap/                 # IPv6 ExtLen wrap PoC (rule 18)
    ├── nodebb/               # ActivityPub UID spoof x2 (rules 47, 48)
    ├── openvpn/              # PAC injection, echo script ACE, DHCP option injection (rules 14, 42, CVE-2026-45115)
    ├── php/                  # SOAP RCE, ASLR bypass (rules 10, 11)
    ├── pillow/               # ImageCms OOB write PoC execution + crash detection (rules 53, 54, 55)
    ├── rustdesk/             # Session bypass x4 (rules 03, 19, 23, 33, 34)
    ├── splunk/               # splunkd child process, reverse shell, REST API, PoC artifact (rules 20, 31, 32, 43)
    └── vlc/                  # VP9 crash/child spawn, WER report, VP9 decode child (rules 04, 29, 30)
    

* * *

## Coverage by Product

* * *

## CVE Coverage

* * *

## Platform Coverage

Platform  
---  
  
* * *

## Priority Rules — Action First

  1. `libssh2/cve-2026-55200-pre-auth-rce-child-process.kql` — CVSS 9.2, active exploitation
  2. `libssh2/libssh2-linkage-recon-ldd-readelf-strings.kql` — catch pre-exploitation recon
  3. `libssh2/cve-2026-55200-libpwn-harness-binaries-endpoint.kql` — harness binaries on disk
  4. `exploitarium-generic/multi-cve-exploitarium-sweep-simultaneous-poc.kql` — broadest sweep
  5. `splunk/cve-2026-20253-splunkd-unexpected-child-process.kql` — high-value enterprise target
  6. `rustdesk/rustdesk-session-permission-bypass-comprehensive.kql` — full multi-branch coverage
  7. `curl/curl-smtp-expn-crlf-injection-attempt.kql` — relevant for any mail-sending SaaS using libcurl



* * *

## Rule Index

* * *

## Usage

Each `.kql` file contains the full rule body plus a metadata header (severity, platforms, MITRE IDs, CVEs, detections.ai link). Import directly into Sentinel as a scheduled query rule or Defender XDR as a custom detection.

Rules are also available in Splunk SPL, Elastic, Chronicle, and other stacks via the detections.ai language translation feature.

* * *

## Author

**Ethan Andrews** Trusted Contributor — detections.ai