Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
187 detections
Filters
Last updated
All Time
Detection languages
131
24
19
7
4
Contributors
57
48
15
11
9
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
108
77
16
16
9
Products / Services
40
40
31
18
17
MITRE Techniques
51
40
37
34
24
CVEs
6
5
5
5
5
This rule monitors for suspicious activity originating from the DHCP Client service process (svchost.exe running with 'Dhcp' in the command line). It detects unauthorized child processes (such as cmd.exe or powershell.exe), unexpected child processes that deviate from established baselines, service crashes potentially indicative of exploitation, and anomalous network connections to non-standard DHCP ports or external IP addresses.
Targets anomalous Netlogon or CLDAP traffic followed by LSASS termination or domain-controller restart indicators. The UDM rule retains principal and target context for correlation.
Detects the generation of core dump files by the Squid proxy server process, which could indicate a crash, segmentation fault, or an attempt to exploit a vulnerability like Squidbleed. This rule specifically looks for 'squid.exe' processes with command line arguments related to core dumps or crashes.
Detects OBS Studio (obs64.exe or obs) crashing or spawning unexpected child processes (sh, bash, cmd.exe, powershell.exe) which could indicate exploitation of a vulnerability, such as the libavcodec MagicYUV decoder vulnerability when processing AVI, MKV, or MOV files.
This rule monitors for suspicious activity originating from the DHCP Client service process (svchost.exe running with 'Dhcp' in the command line). It detects unauthorized child processes (such as cmd.exe or powershell.exe), unexpected child processes that deviate from established baselines, service crashes potentially indicative of exploitation, and anomalous network connections to non-standard DHCP ports or external IP addresses.
This rule detects potential exploit attempts targeting Microsoft Word or Outlook by monitoring process crashes (AccessViolation) initiated by these applications, specifically when the command line indicates the processing of document or email file types (.docx, .eml, .rtf). This could indicate an attempt to exploit a vulnerability in these applications through a specially crafted file.
Detects the generation of core dump files by the Squid proxy server process, which could indicate a crash, segmentation fault, or an attempt to exploit a vulnerability like Squidbleed. This rule specifically looks for 'squid.exe' processes with command line arguments related to core dumps or crashes.
This rule detects potential exploit attempts targeting Microsoft Word or Outlook by monitoring process crashes (AccessViolation) initiated by these applications, specifically when the command line indicates the processing of document or email file types (.docx, .eml, .rtf). This could indicate an attempt to exploit a vulnerability in these applications through a specially crafted file.
Detects Windows Error Reporting (Event ID 1000) events associated with lsass.exe crashes. Memory corruption exploits, such as CVE-2026-41089 (Netlogon RCE), often cause service instability. Monitoring for lsass.exe crashes can reveal failed exploitation attempts or other critical system issues.
Monitors for unexpected process termination or instability events associated with the Windows Netlogon service or lsass.exe (Event IDs 1000, 7031, 7034). This may indicate a failed buffer overflow exploitation attempt related to CVE-2026-41089, which could lead to a denial of service.
This rule detects repeated crashes and restarts of the SolarWinds Serv-U application, indicated by specific event log entries from 'Service Control Manager' or 'Application Error' sources. This pattern is consistent with known exploitation attempts targeting Serv-U.
This rule identifies a high volume of HTTP 5xx errors (server-side errors) within a 5-minute interval from IIS logs. A count of 10 or more errors within this timeframe could indicate a web server under attack, a denial-of-service condition, or a critical application failure.
This rule detects crashes in Nginx worker processes, specifically looking for messages indicating a 'signal 11' or 'SIGSEGV' error. This could be indicative of a vulnerability being exploited (e.g., CVE-2026-42945) or other critical software malfunctions.
This rule detects potential exploitation of CVE-2026-4892 by correlating inbound DHCPv6 traffic (UDP/547) with a dnsmasq process crash (SIGSEGV/SIGABRT exit codes 132, 134, 135, 139) on the same host within a 60-second window. This vulnerability involves sending crafted DHCPv6 messages with oversized Client Identifier options to a dnsmasq server configured with --dhcp-script, leading to a denial of service.
Detects dnsmasq or its DHCP helper child process terminating abnormally on Linux hosts due to signals like SIGSEGV, SIGABRT, SIGBUS, or SIGILL. This behavior is indicative of a crash, potentially caused by exploitation attempts of vulnerabilities such as CVE-2026-4892, a heap buffer overflow in dnsmasq's helper.c when processing oversized DHCPv6 Client Identifier (CLID) options. This rule fires post-impact, complementing network-side detections.
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Detects application popup reporting a failure of the Sysmon service
Detects multiple crashes from key iOS system processes within a short time window. This pattern is indicative of a failed memory corruption attempt, consistent with the sandbox escape and privilege escalation techniques used by the DarkSword exploit kit.
KQL Query
Detects application crashes related to the `jpeg_finish_compress` function in `WindowsCodecs.dll`. This may indicate an exploitation attempt of CVE-2025-50165, a vulnerability triggered by the re-encoding of a malicious 12-bit or 16-bit JPG image.
Page 8 of 9