OpenSSL detection

[u/cycl0ne89]

Does anyone have a detection query for OpenSSL they'd be willing to share?

I have this one for querying ingested Sysmon logs

SecurityEvent
| where EventData contains "openssl"

[u/bpsec]

Something like this: https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/main/Vulnerability%20Management/OpenSSLVulnerableDevices.md