Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15 detections
Filters
Last updated
All Time
Detection languages
4
4
3
3
1
Contributors
14
1
Categories
15
11
10
8
6
Platforms
15
Products / Services
10
9
1
1
1
MITRE Techniques
13
13
8
7
5
CVEs
71
71
64
58
49
Detects reconnaissance and exploit activity associated with the BUMSRAKETE exploit (CVE-2026-45257) targeting FreeBSD. The rule identifies system configuration checks of kernel parameters related to kTLS and mbuf external pages, as well as the execution of file permission manipulation commands often required to bypass immutable (schg) file flags during the exploitation process.
Detects indicators of the BUMSRAKETE FreeBSD kernel-level exploit (CVE-2026-45257). This rule monitors for exploit artifact file creation, malicious use of dd to overwrite SUID binaries for privilege escalation, kernel configuration enumeration via sysctl, spawning of shell processes with root UID from suid-related binaries, and kernel version fingerprinting.
Detects evidence of exploitation for CVE-2026-45257, a FreeBSD vulnerability that allows bypassing chflags schg immutable flags. The detection tracks the initial reconnaissance phase where unprivileged processes query the sysctl 'kern.ipc.mb_use_ext_pgs' followed by the creation of specific exploit restorer artifacts '/tmp/.lpe_orig' and '/tmp/.x'.
Detects post-exploitation activities related to the CVE-2026-45257 BUMSRAKETE vulnerability on FreeBSD. The rule monitors for kernel module loading using kldload from suspicious directories, kldstat execution, unauthorized root-level crontab modifications, and suspicious root-level shell execution spawned from non-standard parent processes, all of which indicate potential persistence or rootkit installation following a local privilege escalation.
Detects execution of the BUMSRAKETE exploit targeting the CVE-2026-45257 FreeBSD kTLS-RX page-cache corruption vulnerability. The rule identifies the exploit binary launching from a non-privileged context alongside the creation of staging files used to corrupt system binaries and escalate privileges to root.
Detects non-privileged execution of system commands (sysctl, freebsd-version, uname) used to query kernel parameters and system configuration. These actions serve as reconnaissance prerequisites for exploiting the BUMSRAKETE (CVE-2026-45257) local privilege escalation vulnerability on FreeBSD systems.
Detects execution and post-exploitation behaviors associated with the BUMSRAKETE exploit, specifically targeting page-cache overwrite privilege escalation (CVE-2026-45257). The rule identifies the presence of malicious binaries, staging artifacts in /tmp, and unprivileged processes spawning shells via SUID binaries (su, passwd) that indicate successful exploitation.
Detects indicators of the BUMSRAKETE exploit targeting a FreeBSD kernel page-cache corruption vulnerability (CVE-2026-45257). The rule triggers on the execution of the exploit binary, creation of specific staging files in /tmp, unauthorized access to SUID binaries, configuration of kTLS socket options (TCP_RXTLS_ENABLE/TCP_TXTLS_ENABLE) by unprivileged users, and pre-exploit reconnaissance using sysctl.
This rule detects various stages of exploitation associated with the CVE-2026-45257 'BUMSRAKETE' vulnerability, which targets FreeBSD kernels. It monitors for the execution of exploit binaries, compilation of source code related to the exploit, the presence of specific staging files in temporary directories, and the subsequent spawning of shells by the exploit process. It also identifies command-line arguments indicative of BUMSRAKETE activity.
Detects reconnaissance activity where an attacker executes system discovery commands to identify the FreeBSD kernel version and kTLS configuration (specifically 'kern.ipc.mb_use_ext_pgs'). This enumeration is performed to fingerprint potential targets for the BUMSRAKETE exploit (CVE-2026-45257).
This rule detects reconnaissance activity on FreeBSD systems by monitoring the execution of 'sysctl', 'uname', 'freebsd-version', and 'pkg' to query sensitive kernel parameters and system version information. Specifically, it flags queries related to CVE-2026-45257 (BUMSRAKETE), such as 'kern.ipc.mb_use_ext_pgs' and 'kern.tls.enable'. The rule differentiates risk levels based on the combination of targeted kernel parameter checks and system version enumeration.
Detects the execution of the BUMSRAKETE exploit for CVE-2026-45257, which targets kTLS-RX page-cache corruption in FreeBSD to achieve local privilege escalation. The rule monitors for pre-exploitation sysctl enumeration of kernel memory management parameters and the subsequent spawning of privileged shells (su/sh) by the exploit process.
Detects the staging of exploit artifacts and subsequent spawning of a shell from a modified SUID binary, indicating the exploitation of CVE-2026-45257 (BUMSRAKETE) to achieve root privilege escalation via page-cache shellcode injection.
Detects indicators of the BUMSRAKETE exploit, specifically looking for malicious binary names, staging files, and a high-frequency loop pattern involving SUID binaries (su, passwd) by unprivileged users. This pattern is consistent with a kTLS page-cache corruption exploit targeting CVE-2026-45257.
This rule detects the spawning of a root shell from specific SUID binaries (su, sudo, doas, passwd, chsh) when the initiating process was run by an unprivileged user. This behavior is indicative of a privilege escalation exploit, potentially related to CVE-2026-45257 (BUMSRAKETE).
