Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
187 detections
Filters
Last updated
All Time
Detection languages
131
24
19
7
4
Contributors
57
48
15
11
9
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
108
77
16
16
9
Products / Services
40
40
31
18
17
MITRE Techniques
51
40
37
34
24
CVEs
6
5
5
5
5
Detects unexpected crashes of major security software agents (e.g., Antivirus, EDR) that are not associated with authorized vendor update or installation activities, potentially indicating tampering or exploitation attempts to disable security controls.
Detects Windows Application Error events where the faulting module is 'nvoglv64.dll'. This is indicative of a crash in the NVIDIA OpenGL/Vulkan user-mode driver, which may be associated with the exploitation of the GreenSection shared-memory corruption vulnerability.
Detects behavioral indicators consistent with local privilege escalation targeting Windows ALPC subsystem vulnerabilities (CVE-2026-85880). The rule correlates: 1) Unsigned or low-prevalence processes loading sensitive ALPC-related DLLs (rpcss.dll, ntdll.dll), 2) Subsequent crashes or restarts of critical ALPC-handling system components (lsass.exe, RPCSS, wuauserv), and 3) The generation of a new SYSTEM-level process by a parent that was not previously running as SYSTEM within a short temporal window.
Detects anomalous activity on WatchGuard Firebox VPN services, specifically monitoring for frequent daemon restarts or crashes (indicating potential RCE attempts) and high-volume bursts of IKE/ISAKMP negotiation failures (potentially indicating malformed packet attacks).
Detects behavioral indicators consistent with local privilege escalation targeting Windows ALPC subsystem vulnerabilities (CVE-2026-85880). The rule correlates: 1) Unsigned or low-prevalence processes loading sensitive ALPC-related DLLs (rpcss.dll, ntdll.dll), 2) Subsequent crashes or restarts of critical ALPC-handling system components (lsass.exe, RPCSS, wuauserv), and 3) The generation of a new SYSTEM-level process by a parent that was not previously running as SYSTEM within a short temporal window.
Detects behavioral indicators consistent with local privilege escalation targeting Windows ALPC subsystem vulnerabilities (CVE-2026-85880). The rule correlates: 1) Unsigned or low-prevalence processes loading sensitive ALPC-related DLLs (rpcss.dll, ntdll.dll), 2) Subsequent crashes or restarts of critical ALPC-handling system components (lsass.exe, RPCSS, wuauserv), and 3) The generation of a new SYSTEM-level process by a parent that was not previously running as SYSTEM within a short temporal window.
Detects behavioral indicators consistent with local privilege escalation targeting Windows ALPC subsystem vulnerabilities (CVE-2026-85880). The rule correlates: 1) Unsigned or low-prevalence processes loading sensitive ALPC-related DLLs (rpcss.dll, ntdll.dll), 2) Subsequent crashes or restarts of critical ALPC-handling system components (lsass.exe, RPCSS, wuauserv), and 3) The generation of a new SYSTEM-level process by a parent that was not previously running as SYSTEM within a short temporal window.
Detects anomalous access to specific memory sections associated with Desktop Window Manager (dwm.exe) followed by a crash of the same process within a 30-minute window. This behavioral pattern is often indicative of exploitation attempts targeting DWM memory management to achieve code execution or privilege escalation.
Detects unexpected crashes of major security software agents (e.g., Antivirus, EDR) that are not associated with authorized vendor update or installation activities, potentially indicating tampering or exploitation attempts to disable security controls.
This rule monitors the Windows Application event log for critical Microsoft SQL Server (MSSQL) events. It detects server crashes, access violations, stack overflows, and high-severity (20+) errors. These events often indicate severe database corruption, underlying system instability, or potential exploitation attempts targeting the database engine.
This rule monitors the Windows Application event log for critical Microsoft SQL Server (MSSQL) events. It detects server crashes, access violations, stack overflows, and high-severity (20+) errors. These events often indicate severe database corruption, underlying system instability, or potential exploitation attempts targeting the database engine.
Detects Cisco network devices experiencing unexpected reloads, crashes, or watchdog resets that are correlated with prior incoming WebVPN, AnyConnect, or SSL VPN HTTP requests. The rule also identifies multiple device reloads occurring within a short 15-minute window, which may indicate a distributed or repeated exploitation attempt against the SSL VPN infrastructure.
Detects devices exhibiting sustained high CPU or memory utilization (>= 90%) for a duration of at least 30 minutes, which may indicate resource exhaustion, performance degradation, or potentially malicious activity such as cryptocurrency mining, denial-of-service, or other unauthorized resource-intensive processes.
Detects the invocation of the Windows Error Reporting service (WerFault.exe) where the command line arguments reference Zoom-related processes (Zoom.exe, CptHost.exe, or zoom.us). This behavior is often indicative of an abnormal application crash, which may be associated with memory corruption exploitation attempts against the Zoom client.
Detects anomalous, frequent, or repetitive device crash events (including BSODs) on a single device, which may indicate system instability, hardware failure, or an attempt to induce a Denial of Service (DoS) condition on the endpoint.
Detects anomalous, frequent, or repetitive device crash events (including BSODs) on a single device, which may indicate system instability, hardware failure, or an attempt to induce a Denial of Service (DoS) condition on the endpoint.
Detects devices exhibiting sustained high CPU or memory utilization (>= 90%) for a duration of at least 30 minutes, which may indicate resource exhaustion, performance degradation, or potentially malicious activity such as cryptocurrency mining, denial-of-service, or other unauthorized resource-intensive processes.
This rule detects the creation of diagnostic crash-dump files within known engineering log directories (e.g., slog, engineermode, vendor/log) within 30 minutes of EngineerModeActivity or YLog execution. This pattern is indicative of potential forensic evidence from an induced modem crash, consistent with known exploit chains targeting specific mobile device vulnerabilities.
Detects the execution of common shell utilities, interpreters, or configuration commands initiated by QEMU or KVM processes. This often indicates the use of virtualized environments to execute payloads, bypass security controls, or hide artifacts within a host system, especially when correlated with process crashes related to hypervisor components.
Detects the execution of common shell utilities, interpreters, or configuration commands initiated by QEMU or KVM processes. This often indicates the use of virtualized environments to execute payloads, bypass security controls, or hide artifacts within a host system, especially when correlated with process crashes related to hypervisor components.
Detects repeated Nginx worker process crashes terminated by signals 6 (SIGABRT) or 11 (SIGSEGV) accompanied by core dumps. High-frequency crashes originating from a single source are indicative of an adversary brute-forcing ASLR in preparation for exploitation of memory corruption vulnerabilities (e.g., buffer overflows or heap clobbering) to achieve remote code execution.
Page 5 of 9