Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
2
2
1
1
1
Platforms
3
2
1
1
Products / Services
2
1
1
1
MITRE Techniques
2
2
1
1
1
CVEs
71
71
64
58
49
Detects SSH client processes linked to libssh2 (such as ssh, curl, sftp, scp) exhibiting sustained high CPU usage (>=95%) for more than 60 seconds while maintaining an active outbound SSH connection. This behavior is consistent with the denial-of-service vulnerability CVE-2026-55199, where an attacker-controlled SSH server provides an excessively large extension count during the key exchange process, triggering an infinite loop within the libssh2 library.
Detects potential container escape attempts leveraging path traversal vulnerabilities in the 'docker cp' command (e.g., CVE-2026-55199). The rule identifies file creation events triggered by docker processes where the target file path is outside the expected Docker root or temporary directory structures, suggesting an effort to write files to arbitrary locations on the host filesystem.
This rule detects potential exploitation of the PHP StreamBucket SOAP RCE vulnerability (CVE-2026-55199). It monitors for characteristic post-exploitation behaviors, including the spawning of unexpected shell or system utility processes, access to sensitive memory mapping files (/proc/self/maps or /proc/self/mem) for ASLR defeat, creation of specific RCE marker files (e.g., /tmp/php857_rce_*.txt), and anomalous outbound network connections following SOAP request activity.