Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects attempts to exploit the SystemInformer (formerly Process Hacker) service (phsvc) for local privilege escalation. The rule monitors for abnormal process spawning by rundll32.exe, the presence of specific PoC artifacts like 'phsvc_rundll_poc.dll', 'systeminformer_phsvc_poc.txt', or command-line arguments containing 'SYSTEMINFORMER_PHSVC_POC', and loading of DLLs from user-writable temporary directories.
Detects Gitea act_runner spawning Docker containers with dangerous runtime flags (e.g., --pid=host, --privileged, --cap-add=ALL) that facilitate host namespace escape. This activity is indicative of exploitation of CVE-2026-20896, where malicious CI/CD workflow YAML files inject these options to break out of the container sandbox and access the host filesystem.
This rule detects potentially malicious activity associated with the exploitation of CVE-2026-45115 in AnyDesk, including the creation of the 'adprinterpipe' named pipe, the spawning of suspicious elevated child processes (e.g., cmd.exe, powershell.exe) by AnyDesk processes, or the installation of services from an AnyDesk process context.
This rule detects suspicious activity related to the Netlogon service or the LSASS process. It triggers on Netlogon service events (5827, 5828, 5829) which may indicate insecure channel usage or service issues often associated with exploitation, and on Sysmon Event ID 1 where a process is spawned by lsass.exe under the SYSTEM user, a behavior frequently seen during credential dumping or privilege escalation attempts.
Detects potential local privilege escalation activity involving AnyDesk. The rule monitors for malicious registry modifications (COM hijack), spawning of suspicious child processes by AnyDesk, creation of specific named-pipe artifacts, unsigned DLL loads from user-writable directories, and unauthorized cross-process injection, potentially linked to CVE-2026-20253.
Detects the installation of a driver service using sc.exe from suspicious, non-standard directories (e.g., Temp, AppData) or involving common driver extensions (.sys). This behavior is indicative of the Bring Your Own Vulnerable Driver (BYOVD) technique, often used to load vulnerable drivers to bypass or disable security products, consistent with activities attributed to various threat actors.
Detects post-exploitation activity related to CVE-2026-55200 (libssh2 heap OOB write), specifically identifying when curl, git, or php processes spawn interactive shells or attempt to access sensitive processes like lsass.exe, indicating a successful exploit chain.
This rule detects potential exploitation of a privilege escalation vulnerability (identified as CVE-2026-46331) involving the manipulation of Linux Traffic Control (tc) pedit actions or user/network namespace unsharing shortly after a setuid binary execution or root shell spawn. This behavior is indicative of a 'Copy-on-Write' (COW) or similar kernel-level vulnerability exploitation chain where unprivileged users abuse system features to gain elevated privileges.
This rule detects indicators of exploitation for CVE-2026-20245 in Cisco Catalyst SD-WAN Manager. It monitors for the upload of malicious tenant configuration files, the creation of unauthorized 'troot' administrative accounts, subsequent lateral movement via 'su', modifications to critical system authentication files like /etc/passwd or /etc/shadow, and post-exploitation configuration exfiltration via REST API endpoints.
Detects the creation of the '\adprinterpipe' named pipe by a process other than authorized AnyDesk binaries. This activity is indicative of a local privilege escalation (LPE) technique where an attacker pre-creates the pipe to impersonate the AnyDesk service and intercept a SYSTEM-level token.
This rule monitors for file system activity associated with the 'libpwn' exploit suite, specifically targeting files related to the exploitation of CVE-2026-55200. It flags the presence of exploit harnesses, probes, and proofs of concept (PoCs) identified by specific filenames and directory structures.
Detects the AnyDesk service-side printer worker process spawning suspicious child processes (e.g., cmd.exe, powershell.exe). This activity is indicative of exploitation attempts against CVE-2026-43503, where an attacker leverages the 'adprinterpipe' named pipe to send malicious COM marshaling bytes and impersonate the LocalSystem identity to escalate privileges.
Detects the drop or installation of known vulnerable drivers associated with the 'The Gentlemen' ransomware group's Bring Your Own Vulnerable Driver (BYOVD) tactics, or the creation of kernel-mode services by unsigned binaries. These techniques are often used to gain kernel-level privileges and disable security software.
Detects the creation of an NTFS Alternate Data Stream (ADS) named :WDFOO on the wermgr.exe process within RP_* staged directories. This behavior is a specific indicator of the RoguePlanet exploit (CVE-2026-50656), which leverages an ADS write to trigger a Microsoft Defender on-access scan and facilitate a TOCTOU (Time-of-Check to Time-of-Use) race condition for privilege escalation or exploitation.
Detects unauthorized processes attempting to access 'wermgr.exe' via a Volume Shadow Copy Service (VSS) device path. This behavior is associated with the RoguePlanet exploit chain (CVE-2026-50656), which leverages VSS to bypass file system protections for TOCTOU (Time-of-Check to Time-of-Use) exploitation. Legitimate system and backup processes are excluded.
Detects a user-mode process attempting to set an opportunistic lock (oplock) on wermgr.exe within a Volume Shadow Copy (VSS) snapshot. This behavior is associated with the RoguePlanet exploit chain (CVE-2026-50656), which leverages VSS snapshots and file locking to trigger a TOCTOU race condition against the Microsoft Defender (MsMpEng.exe) scanner.
Detects potential exploitation of the Zerologon vulnerability (CVE-2020-1472) by correlating computer account password changes (Event ID 4742) with preceding anonymous or null SID logons (Event ID 4624) where the host identifier aligns. The rule identifies anomalous account modifications that occur within a short time window following an anonymous authentication request on the same host.
This rule detects repeated attempts to use privileges for access checks (EventID 4673) by a single user within a one-hour window, excluding the 'SeTrustedCredentialManagerAccessPrivilege'. A high count of such events (5 or more) could indicate an attempt at privilege escalation or unusual system access behavior.
This rule detects HTTP POST requests to the MyBB admin panel (admin/index.php) that attempt to create or modify a user account with membership in the Administrator group (gid=4). The detection requires the presence of an administrator session cookie (adminsid), indicating an attempt by a lower-privileged administrative account to escalate privileges by assigning administrative roles to users.
Detects the creation of files with specific names associated with Proof of Concept (PoC) code, remote code execution (RCE) harnesses, or exploit probes for CVE-2026-55200. This pattern indicates the presence of offensive security tooling or attempted exploitation of a specific software vulnerability on the host.
Detects indicators of the SystemInformer PHSVC (Process Hacker Service) local privilege escalation proof-of-concept. The rule monitors for the loading of the PoC DLL by rundll32, the execution of commands containing specific PoC strings, and the spawning of shell processes by PHSVC-related parent processes.
Page 21 of 45