Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
7
2
2
Contributors
11
Categories
9
7
4
1
1
Platforms
11
Products / Services
8
7
3
1
MITRE Techniques
7
3
1
1
1
CVEs
71
71
64
58
49
Detects a suspicious scenario where a non-root process associated with Acronis backup plugins (typically used on cPanel, WHM, or Plesk servers) spawns a child process that executes with root privileges. This behavior is indicative of potential privilege escalation exploiting CVE-2026-87886.
This rule detects potential privilege escalation to root originating from Acronis backup plugin processes on hosting platforms like cPanel, WHM, and Plesk. It flags cases where a non-root Acronis process spawns a child process with root effective UID or when the process UID itself changes to zero, potentially exploiting vulnerabilities such as CVE-2026-87886. The rule also correlates this behavior with suspicious file permission changes (chmod/chown) on Acronis plugin directories.
Detects local privilege escalation attempts targeting Acronis backup plugins for cPanel, WHM, and Plesk. The rule monitors for instances where backup-related processes or binaries located within control panel paths are executed with root privileges when the parent process was not originated by root, a behavior indicative of exploiting insecure file permissions.
Detects the execution of a shell process (sh, bash, dash, zsh) spawned as a child of Acronis backup agent or plugin processes by the root user. This behavior is indicative of potential exploitation of local privilege escalation vulnerabilities, such as CVE-2026-87886, within Acronis backup plugins for cPanel, WHM, and Plesk.
Detects repeated process execution events associated with Acronis backup plugins for cPanel, WHM, or Plesk within a 15-minute window. This behavior is consistent with automated exploitation attempts, specifically referencing CVE-2026-87886, which target these backup management plugins to achieve privilege escalation or unauthorized system access.
Detects potential exploitation of CVE-2026-87886 in the Acronis Backup plugin for cPanel & WHM, where an adversary uses insecure file permissions to elevate privileges. The rule monitors for execution of file permission or ownership changing utilities (chmod, chown) targeting files associated with backup plugins.
This rule identifies servers running an outdated and vulnerable version (1.9.3 HF3) of the Acronis Backup plugin within cPanel, WHM, or Plesk environments. This specific version is known to be vulnerable to CVE-2026-87886.
Detects potential exploitation of CVE-2026-87886 in the Acronis Backup plugin for cPanel & WHM, where an adversary uses insecure file permissions to elevate privileges. The rule monitors for execution of file permission or ownership changing utilities (chmod, chown) targeting files associated with backup plugins.
Detects a suspicious scenario where a non-root process associated with Acronis backup plugins (typically used on cPanel, WHM, or Plesk servers) spawns a child process that executes with root privileges. This behavior is indicative of potential privilege escalation exploiting CVE-2026-87886.
Detects the use of chmod or chown commands to modify permissions or ownership of files associated with Acronis backup plugins within cPanel, WHM, or Plesk environments. This activity is indicative of potential unauthorized manipulation or exploitation of the backup configuration, such as that associated with CVE-2026-87886.
This rule identifies instances of the Acronis backup plugin for cPanel, WHM, or Plesk running on versions older than 1.9.3 HF3. This versioning threshold corresponds to the patch level required to mitigate the security vulnerability identified as CVE-2026-87886.