Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
41 detections
Filters
Last updated
All Time
Detection languages
15
10
10
3
2
Contributors
36
5
Categories
36
23
19
10
5
Platforms
32
9
5
1
1
Products / Services
28
12
7
4
3
MITRE Techniques
29
25
16
15
7
CVEs
71
71
64
58
49
41
Detects anomalous activity associated with the exploitation of RustDesk session permission bypass vulnerabilities. Specifically identifies 'rustdesk.exe' spawning suspicious child processes (indicative of post-exploitation command execution) or initiating outbound network connections on non-standard relay ports, which may signal a compromised remote access session.
Detects the execution of an executable file that was immediately launched by 7-Zip (7z.exe or 7zG.exe) after processing a file, characteristic of a Mark-of-the-Web (MOTW) bypass exploit involving RAR5 archives. By extracting files from these archives, the 7-Zip process can inadvertently strip or prevent the assignment of the Zone.Identifier Alternate Data Stream, allowing the payload to bypass SmartScreen security prompts.
Detects potential exploitation of RustDesk remote access software, focusing on unauthorized process execution from RustDesk-related binaries (including session relay and rendezvous components) and the presence of documented proof-of-concept (PoC) artifacts associated with session permission bypass vulnerabilities.
This rule detects the extraction of files from RAR5 archives using 7-Zip (7z.exe/7zG.exe), followed closely by the execution of a file from a user-writable directory (e.g., Downloads, Temp, AppData). This behavior is characteristic of an attempt to bypass Mark-of-the-Web (MotW) protections, as files extracted from certain container formats may not inherit the original MotW Zone.Identifier alternate data stream, potentially allowing malicious files to execute without standard Windows security warnings.
Detects suspicious execution patterns originating from Gitea act_runner that indicate potential container escape attempts or host namespace manipulation. The rule flags the use of sensitive docker flags such as --pid=host, --ipc=host, --cap-add=ALL, and security profile unconfining, alongside the execution of 'nsenter' or the existence of specific proof-of-concept markers related to container escape vulnerabilities.
Detects high-risk child processes spawned by 7-Zip (7z.exe, 7zG.exe, 7zFM.exe) when extracting files. This rule is designed to identify potential exploitation of CVE-2026-46331, where 7-Zip fails to properly propagate the Zone.Identifier alternate data stream (Mark-of-the-Web) from RAR5 archives, effectively bypassing SmartScreen security warnings for extracted executables or scripts.
Detects malicious HTTP/1.1 Upgrade requests directed at nghttpx that include a Content-Length body. This combination is characteristic of a request smuggling attack, where an attacker injects a smuggled request into the backend connection. By poisoning the backend queue, the attacker can cause the nghttpx proxy to forward sensitive or malicious responses to victim clients sharing the same connection.
This rule detects potential exploitation of a privilege escalation vulnerability (identified as CVE-2026-46331) involving the manipulation of Linux Traffic Control (tc) pedit actions or user/network namespace unsharing shortly after a setuid binary execution or root shell spawn. This behavior is indicative of a 'Copy-on-Write' (COW) or similar kernel-level vulnerability exploitation chain where unprivileged users abuse system features to gain elevated privileges.
Detects potential exploitation of 7-Zip RAR5 vulnerabilities where the Mark-of-the-Web (MOTW) Zone.Identifier is not propagated during extraction, enabling files to execute without SmartScreen warnings. The rule monitors for the creation of executable file types in common user-writable directories by 7-Zip processes and the subsequent execution of files from those locations by explorer.exe.
Detects Gitea act_runner processes spawning Docker containers with dangerous configurations, such as privileged mode, host namespace mounts, or security-opt bypasses, followed by the execution of 'nsenter' or shell processes, which are indicative of a container escape attempt to the host.
Detects reconnaissance and exploitation setup activities associated with CVE-2026-46331 (pedit COW). The rule identifies processes enumerating kernel versions via system files or commands, checking unprivileged user namespace capabilities, and configuring network traffic control (tc) filters with pedit actions, which are critical precursors to leveraging the pedit page cache corruption vulnerability.
Detects the execution of 'unshare' with flags (such as --user/--net or CLONE_NEWUSER/CLONE_NEWNET) by unprivileged users. This behavior is indicative of attempts to gain CAP_NET_ADMIN capabilities within a new namespace, a necessary precursor to exploiting the pedit COW (CVE-2026-46331) vulnerability for privilege escalation.
Detects the execution of known exploit binaries or the compilation of source files associated with the Linux PACKET_EDIT_MEME exploit (CVE-2026-46331). The rule monitors for specific binary names associated with the exploit, execution of these binaries from common staging directories (/tmp, /dev/shm, /run), and the use of GCC or CC compilers to build the exploit source files.
Detects unauthorized shells (bash, sh, dash, zsh) spawned as root from common setuid binaries (su, sudo, newgrp) by an unprivileged user. This behavior is indicative of the CVE-2026-46331 'pedit COW' vulnerability, where a local attacker performs page cache poisoning on a setuid binary to execute arbitrary code as root without disk modification.
Detects attempts to perform a container escape using path traversal via the 'docker cp' command. This rule monitors for malicious directory traversal sequences, the creation of specific artifacts used in known PoC exploits for container escapes, and the subsequent execution of scripts or shell interpreters by container management processes.
Detects indicators of potential exploitation of CVE-2026-46331 in RustDesk, which involves a session permission bypass. The rule identifies suspicious post-exploitation behavior, specifically when rustdesk.exe spawns common command-line or reconnaissance utilities, and when it initiates outbound network connections on non-standard relay ports.
Detects execution patterns associated with CVE-2026-46331 (pedit COW exploit), which uses a user namespace unshare operation, followed by tc pedit action abuse to perform page cache poisoning on /bin/su to achieve root privilege escalation. The rule monitors for the exploit binary, unshare namespace creation, tc command interaction, unauthorized root shell spawning by su/sudo, and attempts to clear page caches.
Detects the creation of user namespaces combined with network namespace flags using 'unshare' or 'ip netns' by non-root users. This activity is a necessary precursor for exploiting the CVE-2026-46331 vulnerability (pedit COW) to gain CAP_NET_ADMIN capabilities and subsequently corrupt the Linux page cache.
Detects attempts to bypass AppArmor security profiles using aa-exec to execute processes under restricted contexts (trinity, chrome, flatpak), which is a component of the CVE-2026-46331 (pedit COW) exploit chain. Additionally, it monitors for unauthorized removal or disabling of AppArmor policies via aa-disable, aa-teardown, or apparmor_parser -R, which are often indicative of an adversary attempting to weaken system security to facilitate privilege escalation.
Detects host-level configuration changes indicative of preparing a system for the CVE-2026-46331 pedit COW exploit. This includes enabling unprivileged user namespaces via sysctl and disabling security mitigations or removing the act_pedit kernel module.
Detects a sequence of events characteristic of a privilege escalation exploit (referenced as CVE-2026-46331). The chain involves an unprivileged user creating a user namespace, followed by the configuration of traffic-control (tc) filters, and finally accessing sensitive setuid binaries or memory files (/proc/self/mem), indicating an attempt to escalate privileges to root.
Page 1 of 2