Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
72
26
24
17
12
Contributors
62
35
12
11
5
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
93
62
25
21
12
Products / Services
36
31
23
15
12
MITRE Techniques
73
52
42
30
26
CVEs
3
2
IDS Classtypes
2
1
IDS Protocols
2
Detects the disabling of critical encryption enforcement settings on an ESXi host, such as secure boot or executable verification requirements, which may indicate an attempt to weaken hypervisor integrity or allow unauthorized code execution.
Detects instances where the same user performs both a role assignment (potentially for privilege escalation) and executes a Run Command on an Azure Virtual Machine within a one-hour window. This behavior is indicative of an attacker modifying access control and immediately executing arbitrary code on the target resource.
Detects the ESET Management Agent (ERAAgent.exe) initiating outbound network connections using non-standard socket families, specifically AF_VSOCK (virtual socket) or VMCI (Virtual Machine Communication Interface). These interfaces are typically used for inter-process communication between a host and a guest virtual machine, or between guest virtual machines, and may indicate malicious activity such as lateral movement from a virtualized environment, virtual machine escape attempts, or unauthorized communication within an ESXi host environment.
This rule monitors process command lines for identifiers related to virtual machine communication interfaces such as 'VMCI', 'AF_VSOCK', 'svm_cid', or 'vm:2'. It specifically targets both the ESET Remote Administrator (ERA) Agent and any other processes utilizing these communication mechanisms, which can be indicators of inter-process communication across virtual machine boundaries or potential hypervisor-related activity.
This rule monitors process command lines for identifiers related to virtual machine communication interfaces such as 'VMCI', 'AF_VSOCK', 'svm_cid', or 'vm:2'. It specifically targets both the ESET Remote Administrator (ERA) Agent and any other processes utilizing these communication mechanisms, which can be indicators of inter-process communication across virtual machine boundaries or potential hypervisor-related activity.
Detects the ESET Management Agent (ERAAgent.exe) initiating outbound network connections using non-standard socket families, specifically AF_VSOCK (virtual socket) or VMCI (Virtual Machine Communication Interface). These interfaces are typically used for inter-process communication between a host and a guest virtual machine, or between guest virtual machines, and may indicate malicious activity such as lateral movement from a virtualized environment, virtual machine escape attempts, or unauthorized communication within an ESXi host environment.
Detects the ESET Management Agent (ERAAgent.exe) initiating outbound network connections using non-standard socket families, specifically AF_VSOCK (virtual socket) or VMCI (Virtual Machine Communication Interface). These interfaces are typically used for inter-process communication between a host and a guest virtual machine, or between guest virtual machines, and may indicate malicious activity such as lateral movement from a virtualized environment, virtual machine escape attempts, or unauthorized communication within an ESXi host environment.
This rule detects potentially unauthorized or suspicious administrative actions in an Azure environment following a login to specific AI-related applications (AI Gateway, LLM Proxy, or Model Router). It triggers when a user authenticates without applying Conditional Access policies or without Multi-Factor Authentication (MFA), followed immediately (within 30 minutes) by sensitive Azure administrative operations such as role assignments, Key Vault access, or VM write operations.
This rule detects potentially unauthorized or suspicious administrative actions in an Azure environment following a login to specific AI-related applications (AI Gateway, LLM Proxy, or Model Router). It triggers when a user authenticates without applying Conditional Access policies or without Multi-Factor Authentication (MFA), followed immediately (within 30 minutes) by sensitive Azure administrative operations such as role assignments, Key Vault access, or VM write operations.
This rule detects the creation of Google Cloud Platform (GCP) persistent disk snapshots. Monitoring for disk snapshot creation is critical as adversaries may use this functionality to create backups of sensitive virtual machine disks for exfiltration, staging, or offline analysis, effectively bypassing traditional network-based egress controls.
Detects the execution of common shell utilities, interpreters, or configuration commands initiated by QEMU or KVM processes. This often indicates the use of virtualized environments to execute payloads, bypass security controls, or hide artifacts within a host system, especially when correlated with process crashes related to hypervisor components.
Detects the execution of common shell utilities, interpreters, or configuration commands initiated by QEMU or KVM processes. This often indicates the use of virtualized environments to execute payloads, bypass security controls, or hide artifacts within a host system, especially when correlated with process crashes related to hypervisor components.
This rule detects modifications to Google Cloud Compute Engine instance metadata that involve sensitive keys, specifically those related to SSH key injection (ssh-keys, sshKeys, windows-keys) or automated execution via startup scripts (startup-script, startup-script-url). Attackers often modify these fields to achieve persistence or perform privilege escalation on compromised virtual machines.
Detects modifications to the service account assigned to a Google Compute Engine (GCE) instance. An adversary might alter the attached service account to escalate privileges, gain access to additional resources, or maintain persistence by leveraging an identity with higher permissions.
Detects access to Google Cloud Platform virtual machine serial port output. This API call (v1.compute.instances.getSerialPortOutput) allows users to view the console output of a VM instance, which may contain sensitive information, including boot logs, system diagnostic messages, or credentials that were inadvertently logged to the console by services or applications running on the instance.
Detects the creation of a 'Ghost-in-the-Silo' configuration using bindutil.exe with the --runj flag. This pattern is often associated with unauthorized creation of silo-bound containers or execution environments and is monitored for activity outside of legitimate management processes like VM compute, container engines, or Windows Sandbox.
Detects the execution of bindutil.exe with arguments typically used to establish links or silo configurations, excluding known legitimate parent processes associated with container and virtualization services.
Detects the successful creation or update of an Azure Container Instance labeled with 'fortress' that utilizes a MongoDB image from a specific internal container registry.
Detects attempts to grant world-writable (0666) permissions to the /dev/kvm device node using chmod or setfacl, or unauthorized (non-root) accounts interacting directly with the device. Such configuration changes are associated with the Januscape (CVE-2026-53359) vulnerability, which allows local users to exploit a shadow MMU use-after-free in the kernel to escalate privileges to root or escape into the host from a virtualized environment.
Identifies Linux systems acting as KVM hypervisors that are running kernels vulnerable to CVE-2026-53359 (Januscape), a use-after-free vulnerability in the shadow MMU (arch/x86/kvm/mmu/mmu.c). This vulnerability permits a guest virtual machine to escape into the underlying host environment, potentially compromising the hypervisor and other hosted workloads.
Detects rapid succession of power-off, suspend, or destroy operations on virtual machines via esxcli or vim-cmd following an SSH login, a behavior pattern often associated with ESXi ransomware activity (e.g., Qilin).
Page 3 of 9