Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects execution of the tc (traffic control) utility with pedit actions by non-root users. This pattern is indicative of exploitation attempts targeting the Linux kernel act_pedit subsystem (CVE-2026-46331), which can lead to page cache corruption and local privilege escalation.
Detects attempts to bypass AppArmor security profiles using aa-exec to execute processes under restricted contexts (trinity, chrome, flatpak), which is a component of the CVE-2026-46331 (pedit COW) exploit chain. Additionally, it monitors for unauthorized removal or disabling of AppArmor policies via aa-disable, aa-teardown, or apparmor_parser -R, which are often indicative of an adversary attempting to weaken system security to facilitate privilege escalation.
Detects suspicious process execution patterns associated with the exploitation of CVE-2026-46300 (Fragnesia). The rule monitors for the combination of user namespace creation via unshare, network tunnel configuration via ip, and kernel module loading related to ESP or rxrpc, which are indicative of an attempt to trigger a privilege escalation vulnerability in the Linux kernel.
Detects the use of 'unshare' or 'ip' commands by non-root users to manipulate Linux namespaces (e.g., user, network, or xfrm namespaces). These commands can be used to bypass security restrictions, facilitate container escapes, or perform local privilege escalation by exploiting vulnerabilities in the Linux kernel namespace subsystem.
Detects execution artifacts and prerequisite activities associated with the DirtyClone (CVE-2026-43503) local privilege escalation exploit. This includes monitoring for the creation of unprivileged user namespaces, loading specific kernel modules (esp4, esp6, rxrpc) often used in such exploits, compilation of associated exploit source files, and direct interaction with /proc/self/mem to perform memory-based exploitation.
Detects the loading of specific vulnerable drivers (Huawei, Topaz Antifraud, Tower of Fantasy, K7 Security) abused by DragonForce ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software.
This rule detects the installation of known vulnerable kernel drivers (Bring Your Own Vulnerable Driver - BYOVD). These drivers are often exploited by adversaries to gain kernel-level code execution, elevate privileges, or disable security tools (EDR).
Detects the creation of specific vulnerable driver files abused by Gentlemen RaaS EDR killers.
Detects suspicious authentication and management events associated with SD-WAN devices, specifically targeting indicators of CVE-2026-20245 exploitation. The rule monitors for unauthorized SSH access, usage of tenant-upload commands, execution of rogue scripts like vconfd_script_upload_tenant_list, and anomalous peering activity indicative of device injection.
Detects the loading of specific vulnerable drivers (Huawei, Topaz Antifraud, Tower of Fantasy, K7 Security) abused by DragonForce ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software.
Detects the spawning of suspicious child processes (e.g., cmd.exe, PowerShell, node.exe, calc.exe) by the Lunar Client application. This behavior is indicative of an exploit targeting the Electron framework's preload IPC bridge, allowing a renderer process to execute commands or gain elevated privileges on the host system.
This rule detects logon events from Windows Admin Center (WAC) virtual accounts where the associated user principal name (UPN) belongs to an external or unknown tenant. This activity is a key indicator of compromise for CVE-2026-20965, where an attacker uses a forged token from an external tenant to gain unauthorized access.
Detects evidence of AnyDesk exploiting an COM impersonation vulnerability via the adprinterpipe named pipe. The rule monitors for AnyDesk spawning SYSTEM-level child processes, interaction with the adprinterpipe, or modification of critical print-related registry keys.
Detects attempts to modify or bypass AppArmor security profiles using utilities such as aa-complain, aa-disable, or apparmor_parser, correlated with process execution involving user namespace unsharing (e.g., via unshare or CLONE_NEWUSER/CLONE_NEWNET). This combination suggests an attacker attempting to weaken host security controls or perform a container breakout or privilege escalation by manipulating kernel-level namespaces and security policies.
Detects execution of exploit binaries associated with CVE-2026-46331 (pedit COW) or the abuse of legitimate 'tc' (traffic control) and 'unshare' utilities to perform page cache corruption and privilege escalation in user namespace contexts.
This rule detects activities related to the DirtyClone exploit (CVE-2026-43503), including the execution of the exploit binary, the compilation of the exploit from source code using gcc, the use of unshare to prepare network and user namespaces, and suspicious execution of su by non-standard parent processes indicating potential post-exploit root shell acquisition.
Detects the loading of specific vulnerable drivers (Huawei, Topaz Antifraud, Tower of Fantasy, K7 Security) abused by DragonForce ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects an unprivileged process executing from a user-specific temporary directory with the 'RP_' prefix, while simultaneously interacting with specific file patterns in 'C:\Windows\Temp'. This behavior is consistent with the 'RoguePlanet' Time-of-Check to Time-of-Use (TOCTOU) exploit, which uses junction-swap techniques to manipulate Defender quarantine workflow files to achieve privilege escalation.
Detects anomalous activity involving the Windows Error Reporting service executable, wermgr.exe. This includes the suspicious creation of files within temporary directories that match known junction-based exploitation techniques, the creation of a 'wdtest_temp' subdirectory (often used as a working directory in exploit staging), and the execution of wermgr.exe from a path other than the expected Windows System32 directory.
Detects unauthorized access to wermgr.exe residing within Volume Shadow Copy paths or staged in specific temp directories. This behavior is associated with the RoguePlanet exploit, which uses this pattern to obtain SYSTEM-readable handles for subsequent oplock placement and TOCTOU (Time-of-Check Time-of-Use) race conditions to achieve privilege escalation.
Page 28 of 45