Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
This rule detects potential attempts to exploit kernel vulnerabilities related to the Stream Control Transmission Protocol (SCTP) within a containerized environment, followed by suspicious file creation activity in sensitive system directories (e.g., /root/). It correlates logs showing SCTP socket configuration activity with subsequent filesystem modifications within a short 5-minute window.
Detects malicious certificate enrollment requests targeting Active Directory Certificate Services (AD CS) that utilize legacy 'cdc' (Client DC) or 'rmd' (Remote Domain) request attributes, a technique associated with the 'Certighost' exploit (CVE-2026-54121). Additionally, the rule monitors the CA process (certsrv.exe) for suspicious outbound SMB or LDAP connections, which may indicate the abuse of AD CS chase fallback logic to coerce authentication.
This rule detects the execution of 'pkexec' or 'sudo' by a low-privilege web server process (e.g., Apache, Nginx, PHP-FPM) that results in a process running with root privileges. This pattern is indicative of privilege escalation attempts targeting local vulnerabilities, such as CVE-2021-4034 (PwnKit) or CVE-2021-3156 (Baron Samedit), where a compromised web application account attempts to elevate to root.
This rule detects suspicious communication between user-mode processes and kernel-mode drivers using specific Input/Output Control (IOCTL) codes. These IOCTL codes are often associated with known vulnerable drivers that can be exploited for privilege escalation (BYOVD - Bring Your Own Vulnerable Driver) or unauthorized kernel interactions.
This detection query hits on the main activity of NightMare Eclipse's LegacyHive exploit: Placing both the ntuser.dat and UsrClass.dat offline hive files in a folder path matching the pattern C:\<GUID>. This is part of the overall exploit chain, which leverages symlinks and oplocks, to trick the Windows OS into loading a target user's UsrClass.dat. One should never expect to see either of these files in a folder patch like C:\<GUID>, so identifying these files touching this path is an immediate cause for concern.
This rule detects potentially suspicious administrative activity on Check Point Security Management or Multi-Domain servers. It monitors the CommonSecurityLog for specific management-related activities ('command', 'cpm', 'cpca') originating from non-trusted IP ranges. This behavior is indicative of unauthorized management access or exploitation attempts targeting the administrative console of Check Point security appliances.
This rule detects potentially suspicious administrative activity on Check Point Security Management or Multi-Domain servers. It monitors the CommonSecurityLog for specific management-related activities ('command', 'cpm', 'cpca') originating from non-trusted IP ranges. This behavior is indicative of unauthorized management access or exploitation attempts targeting the administrative console of Check Point security appliances.
Detects anomalous certificate issuance via Active Directory Certificate Services (AD CS) where a machine-template certificate is issued to a non-computer requester, but the issued certificate's Subject Alternative Name contains a dNSHostName identifier associated with a Domain Controller. This pattern matches the exploitation of the 'CertiGhost' vulnerability (CVE-2026-54121), which allows unauthorized entities to obtain certificates masquerading as Domain Controllers for potential Kerberos authentication abuse.
Detects cross-process memory copy activity via IOCTL code 0x2220C8 or the MmCopyVirtualMemory kernel routine, associated with the Phantom Mantis G13 EDR-killer driver.
Detects an unsigned process outside standard Windows system directories issuing kernel driver IOCTL 0x2220E4 against three or more distinct target process IDs within a 5-minute window.
Detects processes issuing driver IOCTL codes 0x22208c, 0x222090, or 0x2220c4 associated with the G13 kernel-assisted EDR killer, where the initiating process is unsigned or not signed by a trusted authority.
Detects mass file renaming (ransomware-style encryption behavior) within 30 minutes after execution of Phantom Mantis EDR-killer tooling, indicating endpoint defenses were pinned immediately before ransomware deployment.
Detects a full defense-evasion sequence against the drvsvc kernel service and its drv.sys driver: stop, poll, delete, and re-drop occurring within a short time window.
Detects the DriverKiller BYOVD loader and its embedded vulnerable TG Soft VirIT Agent driver (CVE-2017-17472) by requiring the leftover PDB path artifact together with a known SHA-256 hash match, rather than either indicator alone, to avoid matching legitimate VirIT Agent installations or unrelated files containing only a subset of the indicators
Detects a cross-process kernel memory write primitive invoked via IOCTL control code 0x22209C, where the initiating process is unsigned and the write targets a process other than itself.
Detects process termination with exit code 99 consistent with the VirIT Agent driver abused by DriverKiller, tightly correlated with presence of the DriverKiller service / Viragtlt device on the host.
Detects G13 kernel driver IOCTLs that destructively overwrite process memory (0xCC fill pattern) to disable security agent processes, requiring a distinct identified target process.
Detects IOCTL requests to the Phantom Mantis G12/G13 killer driver used for kernel-mode arbitrary file operations (query/read/write/rename), scoped to unsigned callers targeting security-product install directories.
Detects a user-mode caller sending IOCTL 0x2220E0 to a loaded kernel driver, triggering an attempted system reset via the 8042 keyboard controller.
Detects local processes invoking the splice() syscall with the MSG_SPLICE_PAGES flag to map file descriptors of readable SUID-root binaries directly into network socket buffers. This is the core technique behind CVE-2026-31635 (DirtyDecrypt), which corrupts the page cache of SUID-root binaries by placing their pages into attacker-controlled network packets before authentication completes.
Detects a non-root local process gaining a root shell or executing a SUID-root binary shortly after AF_RXRPC (rxrpc) network socket activity on the same device, consistent with exploitation of the DirtyDecrypt RxGK decrypt-before-authentication flaw to corrupt page-cache pages of SUID-root binaries and gain root.
Page 18 of 45