Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10 detections
Filters
Last updated
All Time
Detection languages
8
2
Contributors
5
5
Categories
8
8
5
5
3
Platforms
10
3
1
Products / Services
7
2
2
1
MITRE Techniques
6
5
5
3
3
CVEs
71
71
64
58
49
Detects evidence of an argument-injection attack against MikroTik RouterOS (CVE-2026-86060), where the attacker provides the literal username '-2' during the login process. This action allows the attacker to bypass standard credential validation by exploiting a forged privilege mask. This is typically observed in conjunction with unauthorized access attempts following CVE-2026-67279.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects anomalous SSH login attempts using the username '-2', which exploits a known argument-injection vulnerability (CVE-2026-86060) in MikroTik RouterOS. This vulnerability allows an attacker to bypass authentication and obtain unauthorized administrative privileges by forcing the login process to read privilege levels from the terminal file descriptor.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects the creation of an administrative-level user account (e.g., 'ops') on a MikroTik RouterOS device shortly after an anomalous login attempt using the '-2' username. This sequence is indicative of the exploit chain associated with specific MikroTik RouterOS vulnerabilities where an unauthenticated or specially crafted login is used to facilitate unauthorized user creation.
Detects the creation of a new local user account named 'ops' or an account with 'full' group privileges on MikroTik RouterOS. This rule is designed to identify potential persistence mechanisms following the exploitation of MikroTrick vulnerabilities (CVE-2026-67279/CVE-2026-86060), often indicated by anomalous prior login patterns.
Detects the presence of an unauthorized administrative account (e.g., 'ops') on MikroTik RouterOS devices following a system 'Flagged' indicator. This rule correlates administrative account creation or modification events with system-reported compromise indicators to identify post-exploitation persistence mechanisms related to known RouterOS vulnerabilities.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
