Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
187 detections
Filters
Last updated
All Time
Detection languages
131
24
19
7
4
Contributors
57
48
15
11
9
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
108
77
16
16
9
Products / Services
40
40
31
18
17
MITRE Techniques
51
40
37
34
24
CVEs
6
5
5
5
5
This rule detects macOS 'sharingd' or 'Foundation' service crashes (stack overflow, recursion limit exceeded, or EXC_BAD_ACCESS) that occur during the processing of plist files. This behavior is indicative of potential memory corruption exploits targeting vulnerabilities in Apple's plist parsing logic, potentially exploited via AirDrop.
This rule detects potential memory corruption or malformed HTTP frame handling issues in macOS services related to AirDrop (AirDrop, sharingd, nsurlsessiond). It specifically monitors unified logs for error messages indicating null pointer dereferences, invalid chunk sizes, or malformed content-length headers within the network.framework stack.
Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).
Detects VLC media player crash conditions or suspicious child process creation immediately following the processing of VP9-encoded video files (.webm, .mkv). This behavior is indicative of potential memory corruption exploitation, such as the vlc-vp9-reschange-crash-poc, which aims to leverage malformed resolution change events for application instability or code execution.
This rule detects when critical Windows services or processes associated with Active Directory (NTDS, Netlogon, LSASS, LDAP) or the Print Spooler (Spooler, spoolsv.exe) crash multiple times (3 or more) on a machine within a 7-day period. This could indicate instability, a denial-of-service attempt, or a system compromise affecting core services.
This rule detects Windows application crash events (Event IDs 1000 and 1001) specifically for 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. The detection triggers when the crash description contains indicators of memory-related instability, such as access violations, heap corruption, or invalid virtual calls, which may suggest exploitation attempts or service instability.
This rule monitors for recurring application crashes involving 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. Frequent crashes of these components may indicate instability, misconfiguration, or an attempt to exploit vulnerabilities within these specific file sharing services.
This rule detects potential exploitation activity related to CVE-2026-45657 involving the Windows Kernel tcpip.sys driver. It monitors for a combination of system crashes (Kernel-Power 41 or EventLog 6008) correlated with Windows Error Reporting (WER) events referencing 'tcpip.sys', or significant spikes in external authentication attempts occurring shortly before a system crash. The rule aims to identify potential remote code execution attempts manifesting as kernel instability.
Detects repeated restarts of vLLM pods (due to OOMKilled, CrashLoopBackOff, or other failure reasons) that are correlated with a burst of multimodal requests. This pattern can indicate a denial-of-service attack, resource exhaustion, or exploitation of vulnerabilities (such as CVE-2026-22778) targeting the vLLM service, potentially leading to service instability or compromise.
Detects potential 'ClickFix' social engineering attacks where users are lured into manually executing malicious PowerShell or CMD commands via the Windows Run dialog following a browser crash, or using finger.exe as a LOLBIN to download payloads.
This rule detects suspicious activities involving the Microsoft Edge browser (msedge.exe). It monitors for the spawning of known command-line utilities (e.g., cmd.exe, powershell.exe) by the browser process and the loading of DLLs that do not originate from expected Windows or Microsoft Edge installation directories. Additionally, it correlates these events with recent Microsoft Edge application crashes on the same host, which may indicate exploitation attempts.
This rule detects potential exploitation of CVE-2026-4892 by correlating inbound DHCPv6 traffic (UDP/547) with a dnsmasq process crash (SIGSEGV/SIGABRT exit codes 132, 134, 135, 139) on the same host within a 60-second window. This vulnerability involves sending crafted DHCPv6 messages with oversized Client Identifier options to a dnsmasq server configured with --dhcp-script, leading to a denial of service.
This rule detects crashes in Nginx worker processes, specifically looking for messages indicating a 'signal 11' or 'SIGSEGV' error. This could be indicative of a vulnerability being exploited (e.g., CVE-2026-42945) or other critical software malfunctions.
This rule detects Windows application crash events (Event IDs 1000 and 1001) specifically for 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. The detection triggers when the crash description contains indicators of memory-related instability, such as access violations, heap corruption, or invalid virtual calls, which may suggest exploitation attempts or service instability.
This rule monitors for recurring application crashes involving 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. Frequent crashes of these components may indicate instability, misconfiguration, or an attempt to exploit vulnerabilities within these specific file sharing services.
Detects segmentation faults or memory corruption crashes in vLLM components associated with media decoding, indicated by specific keywords in syslog messages. This rule aims to identify potential exploitation attempts related to CVE-2026-22778.
This rule detects macOS 'sharingd' or 'Foundation' service crashes (stack overflow, recursion limit exceeded, or EXC_BAD_ACCESS) that occur during the processing of plist files. This behavior is indicative of potential memory corruption exploits targeting vulnerabilities in Apple's plist parsing logic, potentially exploited via AirDrop.
This rule detects potential memory corruption or malformed HTTP frame handling issues in macOS services related to AirDrop (AirDrop, sharingd, nsurlsessiond). It specifically monitors unified logs for error messages indicating null pointer dereferences, invalid chunk sizes, or malformed content-length headers within the network.framework stack.
Detects application crash events recorded in the Windows Application Event Log involving executables named 'quickshare.exe' or 'nearby.exe'.
Detects Microsoft Excel application crashes (Event ID 1000) characterized by an access violation exception code (c0000005). This pattern can indicate an attempt to exploit vulnerabilities in office applications or memory corruption issues, potentially signaling a malicious document exploitation attempt.
Targets anomalous Netlogon or CLDAP traffic followed by LSASS termination or domain-controller restart indicators. The UDM rule retains principal and target context for correlation.
Page 7 of 9