Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,443
11,831
5,872
5,155
4,866
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
This rule correlates three suspicious behaviors occurring within 10 minutes: a non-root process identified as 'bumsrakete' executes, this process accesses the sensitive kernel memory file '/dev/mem', and subsequently, a root process is spawned that is not a standard privilege escalation utility (such as sudo, su, etc.). This sequence of events is highly indicative of potential malicious activity, such as kernel-level exploitation or unauthorized privilege escalation.
This rule monitors process-related logs for specific XGU-prefixed function strings related to access token manipulation and lateral movement, such as token stealing, impersonation, and privilege/UID gathering. The detection looks for these indicators within command line and additional process metadata.
Detects evidence of the SPECTRALVIPER backdoor, specifically targeting its token theft and impersonation capabilities ('XGU::Feature'). The rule monitors for presence of specific internal RTTI class names and method strings in process command lines or activity associated with specific potentially compromised host processes such as OneDrive or Intel Audio services.
Detects user-mode processes abnormally requesting the SeLoadDriverPrivilege token privilege, which is required to load vulnerable drivers into the kernel. This activity is often associated with Bring Your Own Vulnerable Driver (BYOVD) attacks.
Detects the execution of 'sudo npm install -g apintergrationpost', a known command pattern utilized by the MYRA RAT. This pattern leverages sudo for elevated privilege installation via a malicious npm package hook, facilitating potential privilege escalation.
Detects a User Account Control (UAC) bypass technique where eventvwr.exe is used to spawn an elevated shell (cmd.exe or PowerShell). This occurs because eventvwr.exe is an auto-elevating binary that can be manipulated to execute arbitrary commands with high integrity without displaying a UAC prompt.
Detects the execution of the JuicyPotato privilege escalation tool, which exploits COM server permissions to escalate a lower-privileged account to NT AUTHORITY\SYSTEM. The rule monitors process creation events for known file names, command line patterns, and specific argument structures used by this tool.
Detects the execution of 'Mixed Reality.exe' using the 'runas' command-line utility. This pattern is often used to execute binaries with elevated privileges or alternate user contexts, which can be an indicator of potential privilege escalation or lateral movement.
Detects execution patterns indicative of exploitation attempts against the CVE-2024-1086 Linux kernel vulnerability. The rule identifies suspicious usage of networking tools ('tc' with 'pedit'), namespace manipulation ('unshare'), AppArmor profile bypasses ('aa-exec'), and specific malicious binary names associated with proof-of-concept exploits for this vulnerability.
Detects the use of the 'unshare' utility to create new namespaces on Linux systems. Adversaries often use 'unshare' to perform container escapes, escalate privileges, or isolate processes from host-level monitoring. This rule specifically filters out legitimate administrative or container management processes such as systemd, containerd, and runc to reduce noise.
Detects process execution or file creation/modification events associated with the PACKET_EDIT_MEME (pedit_cow_demo) exploit, which targets Linux kernel vulnerabilities (CVE-2026-46331) for local privilege escalation.
Detects instances where the /bin/su binary is executed by a non-root process but succeeds in launching as the root user. This behavior is indicative of potential memory-based privilege escalation exploits, such as page cache poisoning (e.g., pedit COW variants), which allow unauthorized SUID binary execution without modifying the binary on disk.
This rule detects unprivileged processes executing Linux traffic control (tc) commands that leverage the 'act_pedit' action. Such behavior is highly unusual for non-root users and matches the exploitation pattern of the CVE-2026-46331 pedit copy-on-write (COW) kernel vulnerability, which attempts to escalate privileges via netlink socket operations.
Detects the execution of 'unshare' by an unprivileged user to create a new user namespace, followed by a write operation to '/proc/self/uid_map', '/proc/self/gid_map', or '/proc/self/setgroups'. This sequence is a known technique for local privilege escalation (LPE) vulnerabilities, such as those related to unprivileged user namespaces.
Detects instances where a non-SYSTEM parent process spawns a child process running as SYSTEM, characteristic of 'Potato' family exploits (e.g., JuicyPotato, PrintSpoofer) leveraging SeImpersonatePrivilege to elevate privileges. The rule specifically filters for known legitimate SYSTEM process spawners while highlighting suspicious parent-child process relationships.
Detects the creation or modification of WMI event subscriptions via EventID 5861 from the Microsoft-Windows-WMI-Activity log. This activity, involving EventFilters, EventConsumers, or FilterToConsumerBindings, is a well-known technique used by adversaries to establish persistence and achieve execution triggered by system events, often resulting in elevated SYSTEM privileges.
Detects instances where a non-SYSTEM parent process spawns a child process running as SYSTEM, characteristic of 'Potato' family exploits (e.g., JuicyPotato, PrintSpoofer) leveraging SeImpersonatePrivilege to elevate privileges. The rule specifically filters for known legitimate SYSTEM process spawners while highlighting suspicious parent-child process relationships.
Detects Remcos RAT attempting to bypass User Account Control (UAC) by abusing the ICMLuaUtil COM interface (CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7). The rule identifies potential elevation by monitoring for processes executing under a High integrity level that originated from known Remcos installation paths or binary names, as well as registry access to the specific malicious CLSID.
This rule detects the execution of PowerShell with parameters indicating an attempt to elevate privileges using 'Start-Process -Verb RunAs'. This technique can be used to bypass User Account Control (UAC) and execute commands with administrative privileges.
Detects an attempt to bypass User Account Control (UAC) consistent with the Millenium RAT. The rule monitors for the spawning of cmd.exe from non-standard, user-writable directories (such as AppData or Temp) where the parent process launches the shell using the runas verb via ShellExecuteExW with a hidden window, often accompanied by silent command execution.
Detects a sequence of sensitive Windows API calls (AllocateAndInitializeSid, CheckTokenMembership, or ShellExecuteW with runas) occurring within the same process on a host. This behavior is indicative of privilege escalation attempts or unauthorized token manipulation, often observed in malicious processes attempting to elevate privileges or verify token permissions.
Page 35 of 48