Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects artifacts and behavioral patterns associated with the exploitation of the SystemInformer PhSvc (Process Hacker Service) ALPC channel to escalate privileges. The rule monitors for unauthorized rundll32.exe process activity spawning cmd.exe with specific command line arguments, the creation of PoC-related files, and the loading of unsigned modules into the rundll32.exe process.
Detects suspicious unprivileged process behavior associated with the exploitation of CVE-2026-43503 (DirtyClone). The rule identifies non-root users invoking 'unshare' or 'clone' with namespace-related flags (CLONE_NEWUSER, CLONE_NEWNET), followed by critical writes to namespace mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) which are prerequisite steps for elevating to CAP_NET_ADMIN privileges.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects local privilege escalation attempts targeting AnyDesk by exploiting COM object registration. The attack involves registering a malicious COM server in HKCU to intercept the AnyDesk service's interaction with the print pipe, followed by process token impersonation to gain SYSTEM privileges. The rule monitors for unauthorized COM registration, anomalous process execution from AnyDesk, and cross-process access.
Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.
Detects the use of legitimate administrative tools (regsvcs.exe, infinstall.exe, devcon.exe) being executed with command-line arguments indicative of driver or kernel-level installations (e.g., 'kernel', 'ring0', 'driver install'). This behavior is commonly associated with the installation of rootkits or the execution of Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-mode privileges.
Detects a process running as NT AUTHORITY\SYSTEM that was spawned by a parent process not belonging to known legitimate SYSTEM-spawning Windows components. This behavioral pattern is a strong indicator of local privilege escalation (LPE), consistent with techniques such as CVE-2026-41091 (RedSun) and similar LPE exploits.
Detects a potential privilege escalation attempt where an unprivileged user executes a SUID-capable binary (su, sudo, passwd), followed immediately by the creation of a root-owned shell process. This pattern is indicative of exploitation of local privilege escalation vulnerabilities, such as page cache poisoning (e.g., CVE-2026-46331).
Detects the suspicious combination of 'aa-exec' (commonly associated with AppArmor or specific container runtime wrappers) being followed by the execution of 'unshare' with flags used to manipulate kernel namespaces (user, network). This pattern is often indicative of container breakouts or privilege escalation attempts where an adversary leverages namespace isolation to gain higher privileges on the host.
Detects evidence of the DirtyClone (CVE-2026-43503) Linux kernel privilege escalation exploit. The rule identifies a multi-stage attack chain, including the compilation of the exploit binary, creation of unprivileged user and network namespaces required for the exploit, and the use of the 'ip' utility to configure XFRM states/policies for page cache corruption.
Detects in-memory privilege escalation patterns associated with the 'DirtyClone' (CVE-2026-43503) vulnerability. The rule monitors for a sequence of events where an unprivileged process utilizes 'unshare' to create user and network namespaces in conjunction with IPsec XFRM tunnel configurations, immediately followed by the execution of 'su' or 'sudo', resulting in unauthorized root access without disk-based modification of binary files.
This rule detects command line activity associated with the exploitation of a Linux kernel vulnerability involving packet editing (often referred to as the 'pedit' or 'act_pedit' vulnerability). It monitors for the execution of exploit-specific binaries, kernel module loading of 'act_pedit', use of 'unshare' for namespace abuse, and configuration of 'tc' (traffic control) filters related to the exploit.
This rule detects activities associated with the DirtyClone (CVE-2026-43503) privilege escalation vulnerability on Linux systems. It monitors for the execution of exploit binaries from world-writable directories, the modification of critical process memory mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) by non-root users, the use of unshare to create user namespaces as a precondition, and the anomalous spawning of shells by the SUID binary /usr/bin/su.
Detects execution of the CVE-2026-46331 exploit chain, which utilizes unprivileged user namespace creation to escalate privileges followed by malicious Linux traffic control (tc) pedit actions to achieve kernel-level page cache corruption.
Detects a privilege escalation technique that exploits the Windows Error Reporting (WER) 'QueueReporting' scheduled task. An attacker leverages the Task Scheduler COM API to trigger this task, causing 'wermgr.exe' to execute as SYSTEM from an attacker-controlled directory (often via directory junction redirection), subsequently spawning shell processes.
Detects attempts to exploit the Zerologon vulnerability (CVE-2020-1472) for privilege escalation and domain compromise. This rule monitors for a high volume of Netlogon secure channel failures (Event ID 5805), machine account password resets to a zeroed/blank state (Event ID 4742 for computer accounts with specific password indicators), anomalous Netlogon service restarts (Event ID 7036), and Azure AD Identity Protection risk events referencing Zerologon or Netlogon anomalies. These indicators collectively suggest an active exploitation attempt of the Zerologon vulnerability.
Detects execution of tools and scripts known for exploiting the Zerologon (CVE-2020-1472) vulnerability, including zerologon_tester.py, zerologon.py, and Impacket-based Netlogon authentication abuse. The rule monitors command-line activity for these indicators, excluding processes signed by Microsoft.
Detects the execution of the BUMSRAKETE exploit for CVE-2026-45257, which targets kTLS-RX page-cache corruption in FreeBSD to achieve local privilege escalation. The rule monitors for pre-exploitation sysctl enumeration of kernel memory management parameters and the subsequent spawning of privileged shells (su/sh) by the exploit process.
Detects the staging of exploit artifacts and subsequent spawning of a shell from a modified SUID binary, indicating the exploitation of CVE-2026-45257 (BUMSRAKETE) to achieve root privilege escalation via page-cache shellcode injection.
Detects indicators of the BUMSRAKETE exploit, specifically looking for malicious binary names, staging files, and a high-frequency loop pattern involving SUID binaries (su, passwd) by unprivileged users. This pattern is consistent with a kTLS page-cache corruption exploit targeting CVE-2026-45257.
Detects post-exploitation activities on SD-WAN appliances, including unauthorized tenant list uploads related to CVE-2026-20245, creation of unauthorized 'troot' accounts in sensitive system files, staging of system files, unauthorized permission modifications via chmod/chown, and privilege escalation attempts using su.
Page 26 of 45