defensive-exploit-detection

What problem does it solve?

Detect exploit attempts by analyzing crash data to differentiate malicious exploitation from benign faults and enable rapid containment.

Core Features & Use Cases

• Correlates AppCrashed events with subsequent shell processes (cmd.exe, powershell.exe) to identify exploitation attempts.
• Flags DEP/CFG violations and high crash rates to trigger urgent incident response.
• Provides KQL-based queries and guidance for SOC triage, incident response, and vulnerability remediation.
• Useful for endpoint security, web service monitoring, and defensive blue-team workflows.

Quick Start

Load the defensive-exploit-detection skill and begin monitoring crash events and subsequent shell activity to triage suspected exploitation.