Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects SYSTEM processes initiated by non-service user accounts from user-writable locations such as AppData, Temp, Public, ProgramData, and Downloads. This behavior may indicate local privilege escalation and is relevant to post-exploitation activity associated with CVE-2026-68820.
The following analytic detects an unprivileged user invoking the unshare syscall with user namespace flags followed within 120 seconds by a root-owned shell or interpreter spawning under the same parent process, correlating auditd syscall telemetry with Sysmon process creation events to identify the two-step sequence characteristic of user-namespace-based Linux kernel privilege escalation exploits such as DirtyFrag.
This rule detects a suspicious sequence of activities that potentially indicates an attempt to exploit Common Log File System (CLFS) vulnerabilities or manipulate cloud filter drivers for privilege escalation. The rule monitors for a correlation between Registry modifications involving Cloud Filter settings (HKLM\SYSTEM\CurrentControlSet\Services\CldFlt) and the creation or modification of specific CLFS-related files (.blf, .blf2, .regtrans-ms) occurring within a 10-minute window, with an optional check for symbolic link manipulation (NtCreateSymbolicLinkObject).
Detects a SYSTEM-privileged cmd.exe/powershell.exe process spawned in close temporal/process proximity to Microsoft Defender's scanning process (MsMpEng.exe), consistent with successful exploitation of the ShieldBreak zero-day (CVE-2026-50656) TOCTOU bypass. Excludes known legitimate SYSTEM shell spawns from scheduled tasks, SCCM/Intune, and PsExec-style tooling.
Detects the CVE-2026-65400 pre-auth bypass exploitation of macOS Screen Sharing via an oversized RFB SRP (security-type 36) authentication frame length field, correlated with the connection subsequently reaching an authenticated state.
Correlates BTR_CLI arbitrary-write invocations (Action 3) targeting System32\drivers with a resulting file write of a known-malicious hash (e.g., mimidrv.sys) or an unsigned/non-Microsoft-signed binary — detecting the kernel write primitive being used to plant a malicious driver into a protected directory.
Detects the presence of Afd4Eop12_x64.dll or the execution of command lines referencing specific exploit indicators such as 'initialize_afd_npfs_exploit' or 'enable_god_mode', often associated with local privilege escalation exploits leveraging kernel vulnerabilities.
The following analytic detects when the AF_ALG kernel crypto socket interface being loaded more than 300 seconds after system boot, which is a primary kernel-level indicator of Copy Fail (CVE-2026-31431) exploitation activity on Debian and Ubuntu family systems.
The AF_ALG interface is required by the exploit to access the vulnerable authencesn crypto code path, and on systems where it is not auto-loaded at boot, its on-demand registration by an unprivileged process is a strong indicator of exploitation in progress.
The AF_ALG interface is required by the exploit to access the vulnerable authencesn crypto code path, and on systems where it is not auto-loaded at boot, its on-demand registration by an unprivileged process is a strong indicator of exploitation in progress.
Detects the ACRStealer BYOVD driver's ungated IOCTL 0x2205c0 being sent to \\.\DCRCVDRV_U by a non-management process, correlated within 2 minutes with termination of a security/EDR process, indicating kernel-level defense evasion via the vulnerable driver.
Detects the loading of known vulnerable drivers (BYOVD - Bring Your Own Vulnerable Driver) by cross-referencing Sysmon Event ID 6 (Driver Loaded) image hashes with the LOLDrivers.io project database. This technique is often used by adversaries to elevate privileges to kernel mode by exploiting vulnerabilities within signed, legitimate drivers.
Detects the BYOVD kill chain for the DCRCVDrv.sys driver: drop to C:\Windows\Temp\, DCRCVDRV_U/LEGACY_DCRCVDRV_U service installation, device open, and IOCTL 0x2205c0 invocation used to terminate security/EDR processes from kernel context.
Detects the presence of known vulnerable drivers (rwdrv.sys and hlpdrv.sys) associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks. Adversaries utilize these drivers to gain kernel-level access, allowing them to disable security software, escalate privileges, or maintain persistence.
The following analytic detects when su runs from a page-cache-corrupted binary.
When this happens a partial corruption of its runtime state can prevent it from resolving the identity of the calling user.
Under normal conditions, su logs both the target account and the invoking user.
When exploitation has occurred via this path, the invoking username field is absent.
This activity is significant because it indicates a possible privilege escalation attempt, allowing a user to gain root access.
If confirmed malicious, an attacker could achieve full control over the system, execute arbitrary commands, and compromise the entire environment.
When this happens a partial corruption of its runtime state can prevent it from resolving the identity of the calling user.
Under normal conditions, su logs both the target account and the invoking user.
When exploitation has occurred via this path, the invoking username field is absent.
This activity is significant because it indicates a possible privilege escalation attempt, allowing a user to gain root access.
If confirmed malicious, an attacker could achieve full control over the system, execute arbitrary commands, and compromise the entire environment.
Detects MsMpEng.exe creating a file in C:\\Windows\\System32\\.
This should never happen under normal operation Windows Defender does not install kernel drivers at runtime.
In the BlueHammer exploit, the TOCTOU race causes MsMpEng (SYSTEM) to write the attacker's driver payload directly into the drivers directory.
This should never happen under normal operation Windows Defender does not install kernel drivers at runtime.
In the BlueHammer exploit, the TOCTOU race causes MsMpEng (SYSTEM) to write the attacker's driver payload directly into the drivers directory.
The following analytic detects a .wer file being written into the Windows Error Reporting ReportQueue directory by a process other than the standard error-reporting binaries.
Windows Error Reporting normally populates ReportQueue only through werfault.exe, werfaultsecure.exe, or wermgr.exe following an actual application crash.
In the ShieldBreak exploit, the attacker fabricates a .wer report directly and manually invokes the QueueReporting scheduled task, which causes wermgr.exe to process the report and load an attacker-planted phantom DLL at SYSTEM integrity.
If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting.
Windows Error Reporting normally populates ReportQueue only through werfault.exe, werfaultsecure.exe, or wermgr.exe following an actual application crash.
In the ShieldBreak exploit, the attacker fabricates a .wer report directly and manually invokes the QueueReporting scheduled task, which causes wermgr.exe to process the report and load an attacker-planted phantom DLL at SYSTEM integrity.
If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting.
Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session.
RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
Detects the Screen Sharing file-copy helper (SSFileCopySender/SSFileCopyReceiver) running as UID 0/GID 80 while the connected session user is non-root/non-admin, indicating abuse of the arbitrary root file read/write primitive.
This rule detects a suspicious sequence of activities that potentially indicates an attempt to exploit Common Log File System (CLFS) vulnerabilities or manipulate cloud filter drivers for privilege escalation. The rule monitors for a correlation between Registry modifications involving Cloud Filter settings (HKLM\SYSTEM\CurrentControlSet\Services\CldFlt) and the creation or modification of specific CLFS-related files (.blf, .blf2, .regtrans-ms) occurring within a 10-minute window, with an optional check for symbolic link manipulation (NtCreateSymbolicLinkObject).
Detects the execution of an unsigned binary under a non-SYSTEM user context that directly spawns 'whoami.exe' which then runs as the SYSTEM account. This behavioral pattern is indicative of a successful local privilege escalation exploitation, where a malicious binary confirms its escalation by querying the current user identity in a SYSTEM shell. The rule includes exclusions for common administrative agents, such as the Microsoft Intune Management Extension, that may exhibit similar behavior due to periodic detection scripting.
This rule detects the loading of a driver by system utilities (drvinst.exe, pnputil.exe, setupapi.dll, or System process) shortly after a PnP (Plug and Play) device connection event. It specifically flags instances where the driver file is located in suspicious directories (Windows/Temp, Users/Public, AppData/Local/Temp) or the file does not have a .sys extension, which are common indicators of malicious driver installation or BYOVD (Bring Your Own Vulnerable Driver) tactics.
Detects vssvc.exe opening a handle to MsMpEng.exe.
In the RedSun exploit, VSS participates in the cloud-file restore race that directs WD to write through the NTFS junction.
This handle acquisition is observed at the exact moment of exploitation.
vssvc querying MsMpEng is not expected in normal operation.
In the RedSun exploit, VSS participates in the cloud-file restore race that directs WD to write through the NTFS junction.
This handle acquisition is observed at the exact moment of exploitation.
vssvc querying MsMpEng is not expected in normal operation.
Page 16 of 45