Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects a sequence of events characteristic of a privilege escalation exploit (referenced as CVE-2026-46331). The chain involves an unprivileged user creating a user namespace, followed by the configuration of traffic-control (tc) filters, and finally accessing sensitive setuid binaries or memory files (/proc/self/mem), indicating an attempt to escalate privileges to root.
Detects exploitation attempts of the Zerologon (CVE-2020-1472) vulnerability using Impacket tools. The rule monitors for unauthorized machine account password resets via Netlogon, execution of common exploitation scripts like zerologon_tester.py or secretsdump.py, and suspicious NTLM anonymous authentication patterns often associated with the exploit.
Detects a potential privilege escalation attempt targeting the DirtyClone (CVE-2026-43503) vulnerability, where an unprivileged process executes /usr/bin/su with specific command line arguments to spawn a shell without proper authentication, effectively gaining root access.
Detects the exploitation chain of the DirtyClone (CVE-2026-43503) vulnerability on Linux systems. The rule monitors for a sequence involving an unprivileged user (UID > 1000) creating a new user/network namespace, configuring an IPsec XFRM state with loopback source/destination addresses, modifying sensitive memory via /proc/self/mem or /proc/<pid>/mem to bypass Copy-on-Write (CoW) protections, and ultimately spawning a process with root privileges.
Detects the loading of known vulnerable drivers (rwdrv.sys, hlpdrv.sys) used for potential Bring Your Own Vulnerable Driver (BYOVD) attacks, accompanied by evidence of antivirus tampering through process execution or the creation of suspicious directories related to AV killing utilities.
Detects unauthorized attempts to escalate privileges within the MyBB Administrative Control Panel (ACP). The rule identifies malicious activity such as creating an administrator user by assigning usergroup 4, or accessing restricted configuration settings via HTTP POST/GET requests directed at the admin index script.
This rule detects the exploitation of CVE-2026-20245 on Cisco SD-WAN Manager (vManage). It monitors for two distinct phases: 1) The suspicious upload of a tenant-list CSV file via CLI using a malicious filename, and 2) A subsequent privilege escalation attempt where the 'admin' user executes 'su' to switch to a 'troot' user, which is indicative of a backdoor account creation following successful exploitation.
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
Detects symlink or junction point creation by standard users targeting sensitive system directories, a core mechanism of CVE-2026-41091.
This rule detects process execution where the command line arguments contain keywords commonly associated with memory corruption and exploitation (e.g., shellcode, buffer overflow, heap/stack manipulation). The rule further filters for small executable files (less than 100KB) to increase the likelihood of identifying malicious tools or stagers.
This rule detects potential local privilege escalation attempts targeting the AnyDesk service. An attacker can exploit the insecure permissions of the 'adprinterpipe' named pipe created by the AnyDesk service to impersonate a client and execute arbitrary commands with NT AUTHORITY\SYSTEM privileges. The rule monitors for suspicious process creation, COM registration changes, anomalous pipe connections, and suspicious DLL loads stemming from AnyDesk processes.
This rule detects the use of specific Linux utilities often associated with local privilege escalation or container escape techniques. It monitors for commands involving 'unshare' with flags that allow user or network namespace manipulation, network traffic control ('tc') commands specifically interacting with 'pedit' or 'qdisc' which can be abused for kernel-level manipulation, 'ip netns' commands to manage network namespaces, and execution of known exploit-related filenames like 'pedit_cow_demo' or 'packet_edit_meme'.
Detects non-root users utilizing the 'tc' or 'ip' utilities to interact with kernel traffic control structures (qdisc/filter/action) specifically involving 'pedit' actions. This activity is a documented prerequisite for exploiting CVE-2026-46331, a vulnerability enabling page cache poisoning and local privilege escalation.
Detects the creation of user namespaces combined with network namespace flags using 'unshare' or 'ip netns' by non-root users. This activity is a necessary precursor for exploiting the CVE-2026-46331 vulnerability (pedit COW) to gain CAP_NET_ADMIN capabilities and subsequently corrupt the Linux page cache.
Detects unauthorized writes to the /proc/sys/vm/drop_caches interface by non-root users or processes that are not standard system maintenance tools. This activity is a known post-exploitation technique used by exploits like the 'pedit' COW exploit to clear cached setuid binary pages in memory for evasion or cleanup.
Detects suspicious execution of kernel-related networking commands ('unshare', 'ip', 'modprobe', 'insmod') by non-root users that are associated with the setup or exploitation phases of the 'DirtyClone' Linux kernel privilege escalation exploit. The rule specifically looks for IPsec tunnel/policy manipulation or the loading of ESP/RxRPC kernel modules by unprivileged accounts.
Detects anomalous, high-volume file creation patterns in temp directories characterized by UUID-style filenames from non-system processes. This behavior is indicative of a multi-threaded I/O saturation technique used by the RoguePlanet exploit to create a race condition (TOCTOU) against Microsoft Defender (MsMpEng.exe).
Detects anomalous process execution patterns indicative of privilege escalation or persistence on Linux systems. Specifically monitors for unexpected root shell access from non-privileged service accounts (e.g., www-data, apache), abuse of sudo for modifying privileged system files via tee, and execution of binaries from world-writable directories such as /tmp or /dev/shm, which is a common behavior during exploit staging.
Detects instances where the Microsoft Defender service (MsMpEng.exe) spawns common system utilities like cmd.exe, powershell.exe, or wscript.exe running with SYSTEM integrity. This is highly anomalous as Defender should generally not be the parent process for these interactive or script execution shells.
Detects multiple methods commonly used for defense evasion and credential theft on Windows systems, including: enabling WDigest credential caching via Registry modification, execution of forensic tools (FTK Imager) sometimes repurposed for security tool tampering, disabling Microsoft Defender real-time monitoring or removing exclusions via PowerShell/CMD, and loading known vulnerable kernel drivers associated with BYOVD (Bring Your Own Vulnerable Driver) attacks.
This rule detects various stages of exploitation associated with the CVE-2026-45257 'BUMSRAKETE' vulnerability, which targets FreeBSD kernels. It monitors for the execution of exploit binaries, compilation of source code related to the exploit, the presence of specific staging files in temporary directories, and the subsequent spawning of shells by the exploit process. It also identifies command-line arguments indicative of BUMSRAKETE activity.
Page 24 of 45