Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects the creation of UUID-named files within RoguePlanet staging directories (RP_<UUID>) under the %TEMP% path. This activity is indicative of Poseidon thread I/O saturation, a technique used to artificially extend the TOCTOU (Time-of-Check to Time-of-Use) race condition window against the Microsoft Defender service (MsMpEng.exe) as part of an exploit for CVE-2026-50656.
This rule correlates three suspicious behaviors occurring within 10 minutes: a non-root process identified as 'bumsrakete' executes, this process accesses the sensitive kernel memory file '/dev/mem', and subsequently, a root process is spawned that is not a standard privilege escalation utility (such as sudo, su, etc.). This sequence of events is highly indicative of potential malicious activity, such as kernel-level exploitation or unauthorized privilege escalation.
Detects the execution of the JuicyPotato privilege escalation tool, which exploits COM server permissions to escalate a lower-privileged account to NT AUTHORITY\SYSTEM. The rule monitors process creation events for known file names, command line patterns, and specific argument structures used by this tool.
Detects execution patterns indicative of exploitation attempts against the CVE-2024-1086 Linux kernel vulnerability. The rule identifies suspicious usage of networking tools ('tc' with 'pedit'), namespace manipulation ('unshare'), AppArmor profile bypasses ('aa-exec'), and specific malicious binary names associated with proof-of-concept exploits for this vulnerability.
Detects process execution or file creation/modification events associated with the PACKET_EDIT_MEME (pedit_cow_demo) exploit, which targets Linux kernel vulnerabilities (CVE-2026-46331) for local privilege escalation.
Detects instances where the /bin/su binary is executed by a non-root process but succeeds in launching as the root user. This behavior is indicative of potential memory-based privilege escalation exploits, such as page cache poisoning (e.g., pedit COW variants), which allow unauthorized SUID binary execution without modifying the binary on disk.
This rule detects unprivileged processes executing Linux traffic control (tc) commands that leverage the 'act_pedit' action. Such behavior is highly unusual for non-root users and matches the exploitation pattern of the CVE-2026-46331 pedit copy-on-write (COW) kernel vulnerability, which attempts to escalate privileges via netlink socket operations.
Detects the execution of 'unshare' by an unprivileged user to create a new user namespace, followed by a write operation to '/proc/self/uid_map', '/proc/self/gid_map', or '/proc/self/setgroups'. This sequence is a known technique for local privilege escalation (LPE) vulnerabilities, such as those related to unprivileged user namespaces.
Detects instances where a non-SYSTEM parent process spawns a child process running as SYSTEM, characteristic of 'Potato' family exploits (e.g., JuicyPotato, PrintSpoofer) leveraging SeImpersonatePrivilege to elevate privileges. The rule specifically filters for known legitimate SYSTEM process spawners while highlighting suspicious parent-child process relationships.
Detects instances where a non-SYSTEM parent process spawns a child process running as SYSTEM, characteristic of 'Potato' family exploits (e.g., JuicyPotato, PrintSpoofer) leveraging SeImpersonatePrivilege to elevate privileges. The rule specifically filters for known legitimate SYSTEM process spawners while highlighting suspicious parent-child process relationships.
Detects exploitation of CVE-2026-25157 where the OpenClaw AI agent is manipulated to execute arbitrary commands via a malicious SSH target string. The vulnerability allows an attacker to inject command-line options like '-oProxyCommand' into the SSH client, leading to local command execution.
Detects potential Bring Your Own Vulnerable Driver (BYOVD) attacks by monitoring for known vulnerable driver files being created or loaded as kernel modules, as well as the registration of kernel-mode drivers from non-standard or user-writable locations like Temp, Tmp, AppData, or Public directories.
Detects local privilege escalation attempts targeting the SystemInformer (ProcessHacker) PHSVC service. The rule identifies suspicious child process execution from trusted hosts (rundll32.exe, SystemInformer.exe) occurring simultaneously with a connection to the SiSvcApiPort named pipe, which is indicative of the abuse of the SystemInformer service channel for privilege escalation.
This rule detects the loading or execution of known vulnerable kernel drivers. These drivers are often leveraged by adversaries in Bring Your Own Vulnerable Driver (BYOVD) attacks to achieve privilege escalation by exploiting vulnerabilities in the driver to execute code in kernel mode.
Detects the presence of PIL exception messages in application logs that leak heap memory addresses. This is the first stage of the CVE-2026-22778 exploitation chain against vLLM instances used to bypass ASLR.
Detects Potato attack tools for Windows privilege escalation
This rule detects various suspicious activities related to privilege escalation and access token manipulation. It identifies the enablement of sensitive privileges (SeDebugPrivilege, SeTcbPrivilege, SeImpersonatePrivilege) by non-system processes, suspicious API calls for token impersonation/duplication (ImpersonateNamedPipeClient, DuplicateTokenEx) from non-privileged processes, and the creation of SYSTEM child processes by medium-integrity parent processes. These behaviors are often indicative of an attacker attempting to elevate privileges on a compromised system.
This rule detects attempts to exploit MyBB administrative controls. It monitors for two primary patterns: unauthorized privilege escalation where a limited ACP account creates a new Administrator (usergroup=4) user by bypassing access controls, and unauthorized access by limited ACP accounts to restricted administrative modules such as template and plugin management.
This rule detects various stages of exploitation activity associated with the System Informer PHSVC (Process Hacker Service) proof-of-concept (PoC). It monitors for the loading of the PoC DLL via rundll32, the spawning of processes using the specific PoC marker string, unexpected elevated child processes spawned by SystemInformer.exe, and the creation of services or PoC artifacts that facilitate privilege escalation or persistence.
Detects exploitation of the SystemInformer phsvc service via ALPC port abuse and trusted-host bypass. The attack involves loading a malicious DLL into the Microsoft-signed rundll32.exe process to bypass trust checks, subsequently connecting to the '\BaseNamedObjects\SiSvcApiPort' to invoke privileged APIs for LPE.
This rule detects process execution where the command line arguments contain keywords commonly associated with memory corruption and exploitation (e.g., shellcode, buffer overflow, heap/stack manipulation). The rule further filters for small executable files (less than 100KB) to increase the likelihood of identifying malicious tools or stagers.
Page 29 of 45