Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
This rule detects the execution of the `unshare` utility with parameters to create a new user namespace (`-U` or `--user`). This activity is a known precursor for the Dirty Frag Linux kernel Local Privilege Escalation (LPE) exploit, where an unprivileged user can gain elevated privileges. The rule specifically targets Linux process execution events.
This rule detects the execution of the `unshare` utility with parameters to create a new user namespace (`-U` or `--user`). This activity is a known precursor for the Dirty Frag Linux kernel Local Privilege Escalation (LPE) exploit, where an unprivileged user can gain elevated privileges. The rule specifically targets Linux process execution events.
Detects exploitation of CVE-2026-31431 (Copy Fail), a logic flaw in the Linux kernel AF_ALG crypto interface
that allows an unprivileged user to overwrite the page cache of read-only files, including SUID binaries such
as /usr/bin/su, without holding write permissions.
By injecting a payload into the page cache of a SUID binary and executing it, an attacker gains root privileges.
that allows an unprivileged user to overwrite the page cache of read-only files, including SUID binaries such
as /usr/bin/su, without holding write permissions.
By injecting a payload into the page cache of a SUID binary and executing it, an attacker gains root privileges.
Detects the creation of an AF_ALG socket (address family 38) by a non-root user. This is a highly unusual action and serves as a primary early warning indicator for CVE-2026-31431 (Copy Fail) exploitation attempts.
Detects authentication or privilege escalation events where a user account that is normally unprivileged suddenly reports as UID 0. This is a direct artifact of modifying the page cache of /etc/passwd in memory, which is the primary post-exploitation phase of the Copy Fail vulnerability (CVE-2026-31431).
This rule detects the execution of a Python proof-of-concept script named 'exp.py' followed by the execution of the 'su' binary on the same Linux host within a 5-minute window. This correlation is indicative of an attempt to exploit the 'Copy Fail' vulnerability (CVE-2026-31431), which leverages AF_ALG sockets to perform an in-memory page cache overwrite of the 'su' setuid binary to gain a root shell.
Detects Python processes potentially exploiting CVE-2026-31431 ("Copy Fail") by looking for command-line arguments referencing the 'authencesn' cryptography template or known Proof of Concept script names. This exploits a vulnerability in the AF_ALG socket type and splice() to escalate privileges.
Detects the creation of AF_ALG (kernel crypto API) sockets from Python processes or processes explicitly referencing the 'authencesn' cryptographic template. This behavior is heavily associated with the "Copy Fail" (CVE-2026-31431) local privilege escalation exploit, which uses a Python script to chain AF_ALG and splice() to overwrite page cache pages.
Detects the loading of known vulnerable drivers commonly abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to bypass Driver Signature Enforcement (DSE) and gain Ring 0 execution.
This query detects activity associated with the BlueHammer, RedSun, and UnDefend toolset used in post‑exploitation campaigns (including "Nightmare Eclipse" intrusions). It identifies:
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
This query detects activity associated with the BlueHammer, RedSun, and UnDefend toolset used in post‑exploitation campaigns (including "Nightmare Eclipse" intrusions). It identifies:
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
Detects the creation of symbolic links targeting the Restricted kernel object namespace, which the BlueHammer exploit uses for path confusion during a TOCTOU race condition to achieve Local Privilege Escalation.
Detects non-Defender processes accessing or modifying the Defender signature definition file (mpasbase.vdm).
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
This rule detects the loading of drivers that are known to be vulnerable, as listed in the LOLDrivers.io database. It correlates driver load events with a curated list of vulnerable driver hashes (SHA1 and SHA256) to identify potential Bring Your Own Vulnerable Driver (BYOVD) attacks.
Audit CVE Event
Sigma
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
This query identifies HTTP(S) requests logged within Ivanti EPMM (formerly MobileIron) logs that match exploitation URI parameters, specifically looking for '/mifs/c/appstore/fob' and '=gPath' in the HTTP_Request_URI. The EPMM Version number is also extracted to provide additional context for security teams to identify if their software version is vulnerable.
This rule detects privilege escalation events associated with Azure Arc agent processes. It monitors for specific Windows Security Event IDs (4672, 4673, 4674, 4688) where the involved process or its parent is an Azure Arc agent process (himds.exe, azcmagent.exe, gc_worker.exe, gc_service.exe) and the SubjectUserName is not a standard system account. This helps identify potential attempts to elevate privileges using or targeting the Azure Arc agent.
Detects potential exploitation of the RegPwn privilege escalation vulnerability (CVE-2026-24291).
The exploit involves creating a registry symbolic link in a user-writable accessibility configuration path that is later accessed by a SYSTEM process.
This allows an attacker to write to an arbitrary registry location as SYSTEM. This rule detects the creation of the malicious registry symlink, the payload execution where osk.exe modifies a service, and the command-line arguments of the public proof-of-concept tool.
The exploit involves creating a registry symbolic link in a user-writable accessibility configuration path that is later accessed by a SYSTEM process.
This allows an attacker to write to an arbitrary registry location as SYSTEM. This rule detects the creation of the malicious registry symlink, the payload execution where osk.exe modifies a service, and the command-line arguments of the public proof-of-concept tool.
Detects the creation of a system service for NSecKrnl using sc.exe, indicating a potential Bring Your Own Vulnerable Driver (BYOVD) attack. Warlock has been observed utilizing the vulnerable NSecKrnl.sys driver to terminate kernel-level security products before deploying ransomware.
Detects multiple crashes from key iOS system processes within a short time window. This pattern is indicative of a failed memory corruption attempt, consistent with the sandbox escape and privilege escalation techniques used by the DarkSword exploit kit.
Detects instances where the telnetd process spawns the login binary with the '-f' flag. This behavior is indicative of exploitation of CVE-2026-24061, which allows an attacker to bypass authentication by injecting arguments into the login process via a crafted USER environment variable.
Page 34 of 45