defensive-basic-exploitation

What problem does it solve?

Basic exploitation detection enables security teams to identify exploitation attempts by surfacing crash indicators and correlated telemetry in real-time.

Core Features & Use Cases

• Detects stack/heap overflow indicators and use-after-free crashes, along with format-string attack signals.
• Provides crash correlation across processes (WER) and integrates with KQL/MDE telemetry for SOC workflows.
• Supports vulnerability triage and incident response through structured crash signals and telemetry.

Quick Start

Run this skill to begin detecting basic exploitation crashes and surface correlated telemetry for SOC alerts.