Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects anomalous activity associated with the RoguePlanet (CVE-2026-50656) exploit. The rule identifies suspicious file operations by MsMpEng.exe within temporary staging directories (RP_<UUID>), execution of non-Microsoft signed binaries from these staging paths, and unexpected file activity involving 'wdtest_temp' paths, which are indicative of an NTFS junction swap exploit sequence.
Detects signs of the VerdantBamboo threat actor's BRICKSTORM/PLENET campaign, specifically targeting Linux-based edge appliances like pfSense and Synology NAS. The rule monitors for sudo abuse by specific service accounts (e.g., egnyteservice, www-data) attempting to leverage NOPASSWD sudo privileges for the 'tee' utility to write malicious content into sensitive system files (e.g., /usr/sbin/, /etc/cron.d/, /etc/sudoers). Additionally, it identifies unauthorized sudo enumeration commands that may indicate early-stage reconnaissance or persistence efforts.
Detects the creation of specific file and directory structures under the %TEMP% directory associated with the RoguePlanet (CVE-2026-50656) exploit. The exploit utilizes a UUID-named directory prefixed with 'RP_' to stage components, including wermgr.exe and wdtest_temp, required for a junction swap attack against Microsoft Defender. The detection excludes known system processes that might access the temporary folder.
Detects accounts performing multiple sensitive operations, privilege assignments, or privileged service calls in a short timeframe, which may indicate account compromise, reconnaissance, or lateral movement.
Detects post-exploitation activities related to the CVE-2026-45257 BUMSRAKETE vulnerability on FreeBSD. The rule monitors for kernel module loading using kldload from suspicious directories, kldstat execution, unauthorized root-level crontab modifications, and suspicious root-level shell execution spawned from non-standard parent processes, all of which indicate potential persistence or rootkit installation following a local privilege escalation.
Detects execution of the BUMSRAKETE exploit targeting the CVE-2026-45257 FreeBSD kTLS-RX page-cache corruption vulnerability. The rule identifies the exploit binary launching from a non-privileged context alongside the creation of staging files used to corrupt system binaries and escalate privileges to root.
Detects execution and post-exploitation behaviors associated with the BUMSRAKETE exploit, specifically targeting page-cache overwrite privilege escalation (CVE-2026-45257). The rule identifies the presence of malicious binaries, staging artifacts in /tmp, and unprivileged processes spawning shells via SUID binaries (su, passwd) that indicate successful exploitation.
Detects indicators of the BUMSRAKETE exploit targeting a FreeBSD kernel page-cache corruption vulnerability (CVE-2026-45257). The rule triggers on the execution of the exploit binary, creation of specific staging files in /tmp, unauthorized access to SUID binaries, configuration of kTLS socket options (TCP_RXTLS_ENABLE/TCP_TXTLS_ENABLE) by unprivileged users, and pre-exploit reconnaissance using sysctl.
Detects behaviors associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, including the dropping of .sys driver files into non-canonical directories, the registration and execution of kernel services via sc.exe, the use of fltMC to load filter drivers, and the loading of driver modules from non-standard locations.
Detects the dropping, service creation, or execution of known vulnerable drivers and associated BYOVD tools. These tools are used by The Gentlemen RaaS group to escalate privileges to kernel level and terminate endpoint security products.
Detects execution patterns associated with CVE-2026-46331 (pedit COW exploit), which uses a user namespace unshare operation, followed by tc pedit action abuse to perform page cache poisoning on /bin/su to achieve root privilege escalation. The rule monitors for the exploit binary, unshare namespace creation, tc command interaction, unauthorized root shell spawning by su/sudo, and attempts to clear page caches.
Detects execution and compilation activities associated with the DirtyPipe (CVE-2022-0847) vulnerability, which allows an unprivileged user to overwrite data in read-only files, leading to privilege escalation to root. The rule tracks common exploit filenames, compilation patterns, and specific commands used for privilege escalation via unshare or su.
Detects a suspected 5-step exploit sequence targeting CVE-2026-43503 on Linux systems. The rule monitors for unprivileged user and network namespace creation, followed by XFRM state modification, kernel module loading, raw ESP socket creation, and finally writing to /proc/[pid]/mem to facilitate page-cache corruption and bypass Copy-on-Write (CoW) protections.
Detects a sequence of events where a non-root user attempts to manipulate kernel components (specifically involving xfrm/esp modules via ip or modprobe) followed immediately by a sudo or su command, suggesting an attempt to load malicious kernel modules or exploit kernel vulnerabilities to escalate privileges.
Detects potential Windows privilege escalation attempts where a user account is assigned the SeImpersonatePrivilege and subsequently executes known exploitation tools (e.g., Potato-family exploits) within a short window. This pattern often indicates an attempt to escalate to SYSTEM privileges by abusing token impersonation vulnerabilities.
Detects the execution of 'JuicyPotato', a known tool used for local privilege escalation on Windows systems by abusing the BITS service or DCOM to achieve arbitrary process execution as SYSTEM.
Detects host-level configuration changes indicative of preparing a system for the CVE-2026-46331 pedit COW exploit. This includes enabling unprivileged user namespaces via sysctl and disabling security mitigations or removing the act_pedit kernel module.
Detects AnyDesk spawning suspicious child processes (cmd, powershell, etc.) indicative of local privilege escalation via the AnyDesk printer COM object impersonation vulnerability. This technique involves an attacker-controlled process communicating with the AnyDesk service's named pipe (adprinterpipe) to trigger code execution in the context of the LocalSystem AnyDesk service.
Detects CldFlt.sys driver load activity coinciding with SyncRootManager registry modifications by non-standard processes, indicating potential RedSun exploitation of CVE-2026-41091 via the Cloud Files filter driver path. This correlation suggests an attempt to establish persistence or escalate privileges by manipulating system components related to cloud file synchronization.
Detects the deployment, registration, and loading of known vulnerable drivers (e.g., mhyprot2.sys, gdrv.sys, rtcore64.sys) used in Bring Your Own Vulnerable Driver (BYOVD) attacks. This rule monitors file creation, module loading, service registration via sc.exe, and registry modifications associated with service installation.
This rule detects potential privilege escalation activity associated with the abuse of CTFMON related objects (named pipes, symlinks, junctions) which may be used in conjunction with high-privilege operations (like SeDebugPrivilege or SeImpersonatePrivilege) to elevate access to SYSTEM. It correlates access events for CTF objects by processes (other than the legitimate ctfmon.exe) with subsequent sensitive privilege assignments within a short time window.
Page 23 of 45