Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
This rule correlates commands indicative of privilege escalation (checking local administrator groups or user privileges) with subsequent manipulation of Quality of Service (QoS) policies via WMI. This sequence of events suggests an attacker gaining elevated privileges and then attempting to throttle network traffic, potentially to hinder EDR/security tool communication or data exfiltration.
Detects the loading of known vulnerable or unsigned drivers, specifically targeting Huawei-signed driver variants, which have been leveraged by DragonForce for Bring Your Own Vulnerable Driver (BYOVD) defense evasion. The rule identifies driver loads where the file name matches known vulnerable Huawei drivers or where the driver is loaded by an unusual process and not from a standard system directory, and is also untrusted.
This rule detects the execution of 'GodPotato-NET4.exe', a known tool used to escalate privileges to SYSTEM on Windows systems. Detection is based on the file name or its presence in the process command line.
Detects the execution of known Windows privilege escalation tools commonly used in post-exploitation scenarios, such as JuicyPotato, PrintSpoofer, and other 'Potato' variants, by monitoring for process file names associated with these utilities.
Detects 'gp_v6_exec.py', a script automating GodPotato privesc for MuddyWater. This rule specifically looks for the execution of this Python script via its command line.
Detects the use of specific Linux utilities often associated with container escape or privilege escalation exploits. This includes the use of 'aa-exec' with restricted profiles, 'unshare' for namespace manipulation, and specific command-line patterns targeting vulnerability-related exploitation scripts.
Detects activities associated with the exploitation of the Netfilter vulnerability CVE-2023-32233. The rule monitors for the compilation or execution of known exploit binaries (e.g., packet_edit_meme), the use of 'unshare' for namespace-based privilege escalation (gaining CAP_NET_ADMIN), the loading of the 'act_pedit' kernel module, and potential AppArmor bypass attempts via 'aa-exec'.
Detects execution of Linux Traffic Control (tc) commands, module loading, or specific strings related to the exploitation of CVE-2026-46331, involving the act_pedit kernel component. These activities are associated with a potential kernel-level copy-on-write (COW) page cache corruption vulnerability that could be used for privilege escalation.
Detects the execution of the Linux 'tc' (traffic control) utility with 'act_pedit' by an unprivileged (non-root) user. This pattern is associated with attempts to leverage the CVE-2026-46331 vulnerability, which involves a Copy-on-Write (COW) kernel exploit triggered through malicious netlink operations in the traffic control subsystem to achieve privilege escalation.
Detects execution of known Proof-of-Concept binaries (pedit_cow_demo or packet_edit_meme) followed by /bin/su spawning /bin/sh, which indicates successful exploitation of the pedit COW vulnerability resulting in shellcode execution with root privileges.
Detects potential Bring Your Own Vulnerable Driver (BYOVD) attacks by monitoring for known vulnerable driver files being created or loaded as kernel modules, as well as the registration of kernel-mode drivers from non-standard or user-writable locations like Temp, Tmp, AppData, or Public directories.
Detects the deployment, registration, and loading of known vulnerable drivers (e.g., mhyprot2.sys, gdrv.sys, rtcore64.sys) used in Bring Your Own Vulnerable Driver (BYOVD) attacks. This rule monitors file creation, module loading, service registration via sc.exe, and registry modifications associated with service installation.
Detects the execution of known privilege escalation tools such as SweetPotato, JuicyPotato, RoguePotato, PrintSpoofer, and BadPotato. These tools are commonly used by attackers to escalate privileges on compromised Windows systems.
Detects the threat actor dropping the vulnerable EnCase driver (EEDbg.sys or similarly signed legacy driver) to disk to initiate the BYOVD attack.
Identifies the execution of the W2 malvertising loader dropping known vulnerable drivers (e.g., RTCore64, gdrv, procexp) to disk for the Bring Your Own Vulnerable Driver attack. This rule specifically looks for '.sys' files being created in common temporary or user-specific directories (Temp, AppData\Local, Users\Public) where the initiating process was a web browser (chrome.exe, msedge.exe) or explorer.exe.
Identifies local devices sending crafted UPnP requests to the local gateway to programmatically alter DNS settings. This rule specifically looks for UDP traffic on port 1900 (UPnP) originating from processes like curl.exe or powershell.exe, which could indicate an attempt to exploit router UPnP vulnerabilities for DNS hijacking.
Detects exploitation of application vulnerabilities for denial of service
Maps the behavioral transition where the Bomgar process spawns a child process that immediately executes commands requesting or manipulating SYSTEM or root level privileges.
Detects the use of legitimate administrative tools (regsvcs.exe, infinstall.exe, devcon.exe) being executed with command-line arguments indicative of driver or kernel-level installations (e.g., 'kernel', 'ring0', 'driver install'). This behavior is commonly associated with the installation of rootkits or the execution of Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-mode privileges.
This rule detects the usage of standard Windows system administration utilities (infinstall.exe, devcon.exe, pnputil.exe, sc.exe) when the command line arguments include keywords commonly associated with driver loading or kernel-level operations, which may indicate the installation of a rootkit or malicious driver.
Detects the loading of the Huawei HWAuidoOs2Ec.sys driver, which has been abused in Bring Your Own Vulnerable Driver (BYOVD) attacks for defense evasion and privilege escalation.
Page 31 of 45