Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
MiniPlasma PoC Registry Artifacts
Cortex XDR
Detects the creation of specific registry keys in the .DEFAULT user hive associated with the MiniPlasma (CVE-2020-17103) proof-of-concept exploit. This exploit is a privilege escalation vulnerability.
Identifies instances where curl is used to interact with a mounted Docker Unix socket. This technique is used to issue API commands directly to the Docker daemon, often to deploy new privileged containers for host escape.
This rule detects the loading of known vulnerable drivers (BYOVD) or drivers from suspicious user-writable paths, combined with the termination of security products. This combination of events is highly indicative of an adversary attempting to gain kernel-level privileges and disable defenses.
This rule detects the loading of known vulnerable drivers (BYOVD) or drivers from suspicious user-writable paths, combined with the termination of security products. This combination of events is highly indicative of an adversary attempting to gain kernel-level privileges and disable defenses.
Detects modifications to the Windows registry that disable the
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Detects modifications to /home/vmanage-admin/.ssh/authorized_keys on Cisco SD-WAN controllers (vSmart, vManage, vBond) by any process. This file is a post-exploitation persistence target documented by Resecurity and Rapid7 for CVE-2026-20182. Legitimate modifications to this file are extremely rare in production SD-WAN deployments, as the vmanage-admin account is an internal service account and its authorized_keys file is provisioned during initial deployment and rarely touched afterward. Any write event is worth immediate investigation.
Detects the loading of kernel modules using insmod. Executing this from within a container or unexpected context often indicates abuse of CAP_SYS_MODULE to load malicious rootkits or reverse shells for privilege escalation or container escape.
Detects exploitation attempts of CVE-2026-48172 in the LiteSpeed User-End cPanel Plugin. Attackers abuse the redisAble function to escalate privileges, potentially to root, by mishandling Redis enable/disable features.
Detects the execution of the public Proof-of-Concept for the "Dirty Frag" Linux Kernel Privilege Escalation vulnerability. It monitors for the specific command-line flags '--force-esp' and '--force-rxrpc', as well as the execution of /bin/sh or /bin/bash with the TERM=xterm environment variable, which is indicative of the PoC's payload.
Detects the registration of the PLURIBUS Cloud Files sync provider used by the CVE-2023-36036 (cldflt.sys heap overflow) privilege escalation exploit in the Rapid7-documented ModeloRAT incident. The exploit registers a fake sync provider with the specific GUID {904EE598-0511-4664-82A8-22C4A7501044} pointing to %TEMP%\cldflt\, then writes a placeholder file (Link.log) to trigger the vulnerable code path. The provider GUID, name, and registry path are all unique to this exploit variant — legitimate sync providers (OneDrive, Dropbox, Box) use vendor-specific GUIDs and never register under %TEMP%.
Detects dnsmasq or its DHCP helper child process terminating abnormally on Linux hosts due to signals like SIGSEGV, SIGABRT, SIGBUS, or SIGILL. This behavior is indicative of a crash, potentially caused by exploitation attempts of vulnerabilities such as CVE-2026-4892, a heap buffer overflow in dnsmasq's helper.c when processing oversized DHCPv6 Client Identifier (CLID) options. This rule fires post-impact, complementing network-side detections.
This rule identifies 'chokepoint' devices within an environment based on their high number of inbound and outbound connections (at least 2 each). It then enriches these chokepoint devices with vulnerability and misconfiguration remediation recommendations from Microsoft Defender for Endpoint (MDE) TVM and Exposure Graph. The rule prioritizes remediation based on the calculated 'ChokepointScore' (InboundCount * OutboundCount) and indicates if the device has active exploits. This helps security teams focus remediation efforts on critical assets that could significantly impact the network if compromised.
https://www.microsoft.com/en-us/security/blog/2026/05/08/active-attack-dirty-frag-linux-vulnerability-expands-post-compromise-risk/
Query looks for non-root users launching the switch user (su) process via a parent process other than the normally expected processes such as shells, sudo, or su itself.
Detects the addition of malicious RxRPC v1 tokens to the process keyring. This behavior is indicative of the RxRPC variant of the Dirty Frag Linux local privilege escalation exploit. The exploit uses the add_key syscall to plant a session key used for in-place pcbc(fcrypt) decryption, targeting privileged files like /etc/passwd.
Query looks for potential CopyFail proof of concept (POC) code execution via identifying potentially correlated curl and su process executions. May identify false positives, yet works well for identification of CopyFail POC provided by Xint.Code.
Detects write operations or modifications to 'uid_map', 'gid_map', or 'setgroups' files within the /proc directory.
The xfrm-ESP variant of the Dirty Frag (CVE-2026-43284) vulnerability relies on creating new user and network namespaces, and mapping user/group IDs to root (0) to gain CAP_NET_ADMIN privileges. This setup phase allows the exploit to bypass namespace restrictions and register malicious XFRM Security Associations.
Note: Traditional auditd watches cannot monitor the /proc pseudo-filesystem directly. This detection relies on EDRs or eBPF-based sensors that can hook into file operations.
The xfrm-ESP variant of the Dirty Frag (CVE-2026-43284) vulnerability relies on creating new user and network namespaces, and mapping user/group IDs to root (0) to gain CAP_NET_ADMIN privileges. This setup phase allows the exploit to bypass namespace restrictions and register malicious XFRM Security Associations.
Note: Traditional auditd watches cannot monitor the /proc pseudo-filesystem directly. This detection relies on EDRs or eBPF-based sensors that can hook into file operations.
Detects the addition of RxRPC tokens to the process keyring using the `add_key` system call or `keyctl` command.
The RxRPC variant of the Dirty Frag (CVE-2026-43500) vulnerability leverages malicious RxRPC v1 tokens to perform an offline brute-force attack and achieve local privilege escalation via a page-cache write.
Monitoring for unexpected RxRPC key additions helps identify potential exploitation of this vulnerability.
The RxRPC variant of the Dirty Frag (CVE-2026-43500) vulnerability leverages malicious RxRPC v1 tokens to perform an offline brute-force attack and achieve local privilege escalation via a page-cache write.
Monitoring for unexpected RxRPC key additions helps identify potential exploitation of this vulnerability.
Detects a process modifying multiple privileged namespace mapping files (uid_map, gid_map, setgroups) under /proc. This behavior is used by the Dirty Frag xfrm-ESP exploit variant to gain CAP_NET_ADMIN privileges prior to exploiting the Linux kernel page-cache write vulnerability.
Detects attempts to bind an AF_ALG socket to the pcbc(fcrypt) cryptographic cipher. The Dirty Frag (CVE-2026-43500) RxRPC exploit variant leverages this highly unusual cryptographic combination to perform offline key brute-forcing in user-space to predict decrypted file offsets. This rule covers eBPF telemetry arguments, standard command-line logging (to catch potential kernel `modprobe` triggers), and auditd SOCKADDR hex-encoded structures.
Huntress has observed Tiflux being used in attacks that aim to establish persistence, transmit screenshots, and run commands to collect system profiling information.
Threat actors behind the rogue Tiflux incidents also installed UltraVNC, an open-source remote access tool, sideloaded other commercial RMMs, including Splashtop and ScreenConnect, and installed an outdated driver that can permit the threat actor to elevate their own privileges on an infected system.
Threat actors behind the rogue Tiflux incidents also installed UltraVNC, an open-source remote access tool, sideloaded other commercial RMMs, including Splashtop and ScreenConnect, and installed an outdated driver that can permit the threat actor to elevate their own privileges on an infected system.
Page 33 of 45