Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects suspicious patterns of driver loading activity, specifically looking for multiple driver load attempts (sc create, sc start, net start, wmic service) involving .sys, kernel, or driver files from non-System32 directories or within the Temp directory. This pattern can indicate an attempt to install a rootkit or other malicious kernel-mode software.
Detects command-line activity associated with the Print Spooler service (`printspooler` or `spoolsv.exe`) that also contains keywords indicative of exploitation or privilege escalation (e.g., `exploit`, `privilege`, `admin`). This rule aims to identify attempts to leverage Print Spooler vulnerabilities for privilege escalation.
This rule detects multiple unauthorized access attempts (5 or more within an hour) to sensitive Active Directory objects such as 'Admin', 'krbtgt', or 'Domain Admins'. It leverages Windows Security Event ID 4662, which indicates an operation was performed on an object, and filters for specific sensitive object names. The rule then groups these attempts by object, IP address, and user, alerting when a threshold of attempts is met.
An unprivileged user can gain root access on major Linux distributions by exploiting CVE-2026-31431, a deterministic 4-byte page cache write bug in the authencesn cryptographic template.
The 'Copy Fail' vulnerability (CVE-2026-31431) is a critical logic flaw in the Linux kernel's crypto subsystem disclosed by Xint Code. Unlike previous high-profile kernel exploits that relied on race conditions, Copy Fail is a straight-line logic bug that allows an unprivileged local user to perform a controlled 4-byte write into the page cache of any readable file. This enables an attacker to modify the in-memory version of setuid binaries (like /usr/bin/su) to execute arbitrary shellcode as root without changing the file on disk.
Vulnerability affects Linux Kernel version starting 4.14 before 6.18.22.
The 'Copy Fail' vulnerability (CVE-2026-31431) is a critical logic flaw in the Linux kernel's crypto subsystem disclosed by Xint Code. Unlike previous high-profile kernel exploits that relied on race conditions, Copy Fail is a straight-line logic bug that allows an unprivileged local user to perform a controlled 4-byte write into the page cache of any readable file. This enables an attacker to modify the in-memory version of setuid binaries (like /usr/bin/su) to execute arbitrary shellcode as root without changing the file on disk.
Vulnerability affects Linux Kernel version starting 4.14 before 6.18.22.
Detects loading of GameDriverx64.sys, which has been identified as a vulnerable driver (CVE-2025-61155) that can be exploited for kernel-level privilege escalation.
Detects the host-level command execution artifact left behind by the published ITScape (CVE-2026-46316) exploit proof-of-concept. The PoC specifically executes a payload containing '/bin/touch /ITScape' after achieving host kernel privilege from a KVM/arm64 guest. This rule looks for processes executing this specific command string.
Detects Shellshock bash CGI exploitation attempts
Detects exploitation of application vulnerabilities for denial of service
This rule detects the spawning of a root shell from specific SUID binaries (su, sudo, doas, passwd, chsh) when the initiating process was run by an unprivileged user. This behavior is indicative of a privilege escalation exploit, potentially related to CVE-2026-45257 (BUMSRAKETE).
Detects Shellshock bash CGI exploitation attempts
This rule detects multiple unauthorized access attempts (5 or more within an hour) to sensitive Active Directory objects such as 'Admin', 'krbtgt', or 'Domain Admins'. It leverages Windows Security Event ID 4662, which indicates an operation was performed on an object, and filters for specific sensitive object names. The rule then groups these attempts by object, IP address, and user, alerting when a threshold of attempts is met.
This rule detects attempts to exploit the Zerologon (CVE-2020-1472) vulnerability, a critical privilege escalation flaw in Microsoft's Netlogon Remote Protocol. It specifically looks for network traffic on TCP port 445 (SMB) containing the 'NetrServerAuthenticate3' function call with a specific sequence of null bytes, which is indicative of an unauthenticated Netlogon session setup without signing and sealing, a key characteristic of the Zerologon exploit.
This rule detects the delivery of a kernel exploit via HTTP. It specifically looks for HTTP responses (flow:to_client) containing a file with the 'MZ' header (indicating a Windows executable) and the string 'exploit' (case-insensitive) in the HTTP URI. This combination suggests an attempt to deliver a malicious executable, potentially a kernel exploit, to a client system.
This rule detects repeated attempts to use privileges for access checks (EventID 4673) by a single user within a one-hour window, excluding the 'SeTrustedCredentialManagerAccessPrivilege'. A high count of such events (5 or more) could indicate an attempt at privilege escalation or unusual system access behavior.
Detects suspicious patterns of driver loading activity, specifically looking for multiple driver load attempts (sc create, sc start, net start, wmic service) involving .sys, kernel, or driver files from non-System32 directories or within the Temp directory. This pattern can indicate an attempt to install a rootkit or other malicious kernel-mode software.
Detects command-line activity associated with the Print Spooler service (`printspooler` or `spoolsv.exe`) that also contains keywords indicative of exploitation or privilege escalation (e.g., `exploit`, `privilege`, `admin`). This rule aims to identify attempts to leverage Print Spooler vulnerabilities for privilege escalation.
EternalBlue SMB Exploit Attempt
Suricata
This rule detects attempts to exploit the EternalBlue vulnerability over SMB (Server Message Block) protocol. It specifically looks for a sequence of bytes indicative of the exploit payload within the SMB traffic.
This rule detects suspicious post-exploitation activity originating from the BeyondTrust/Bomgar session process, `bomgar-scc.exe`. It identifies the execution of common Windows command-line interpreters and scripting environments (`cmd.exe`, `powershell.exe`, `pwsh.exe`, etc.) or the presence of specific command-line substrings indicative of privilege escalation, credential access, reconnaissance, lateral movement, defense evasion (like log clearing), or download/execution cradles. The rule assigns a risk score based on the detected activities and triggers an alert if the cumulative score and unique child process count exceed predefined thresholds, suggesting a high-confidence post-exploitation scenario.
This rule detects attempts to exploit the PrintNightmare vulnerability over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "spoolss" and "RpcAddPrinterDriverEx" in a case-insensitive manner, indicating an attempt to leverage the Print Spooler service for privilege escalation.
This rule detects the download of files with names indicative of 'Potato' privilege escalation tools. It specifically looks for HTTP URI patterns containing 'potato' preceded by terms like 'sweet', 'juicy', 'rogue', 'bad', or 'print', case-insensitively. The detection is triggered on HTTP traffic flowing from the server to the client.
The “YellowKey” vulnerability disclosed on May 12, 2026, allows attackers with physical access to bypass BitLocker encryption on Windows 11 and Windows Server 2022/2025, gaining full access to protected data without a recovery key or PIN. Microsoft has not yet confirmed the issue or released a patch.
Ref: https://blackfort-tec.de/en/insights/yellowkey-bitlocker-bypass-windows-11-vulnerability
Ref: https://blackfort-tec.de/en/insights/yellowkey-bitlocker-bypass-windows-11-vulnerability
Page 32 of 45