Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
This rule detects the presence, installation, or execution attempts of the known vulnerable GIGABYTE driver (gdrv.sys). Monitoring for this specific driver is a common practice to identify attempts to perform 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, which can be used for kernel-mode code execution and privilege escalation.
Detects the creation of Object Manager symbolic links that redirect the Windows Defender 'WD_SCAN' object to a loopback UNC share path. This behavior is indicative of a symlink exploitation technique (ShieldCrash/CVE-2026-69414) used to manipulate Windows Defender or associated scan operations by redirecting them to an adversary-controlled or loopback-hosted target.
Detects anomalous MS_T120 channel binding and MCS handshake patterns characteristic of the BlueKeep (CVE-2019-0708) remote code execution vulnerability in Microsoft RDP services.
Detects EDRKiller.exe or WarsawKiller.exe binaries and the associated wsftprm.sys BYOVD driver used by The Gentlemen threat actor to terminate security product processes
Detects the loading of known vulnerable kernel drivers 'truesight.sys' or 'rentdrv2.sys'. These drivers are frequently abused in Bring-Your-Own-Vulnerable-Driver (BYOVD) attack chains, where attackers leverage specific IOCTL calls (such as 0x22E044 or 0x22E010) to interact with the driver to perform privileged actions, such as terminating security processes.
Detects evidence of the Alinubx.sys kernel driver being loaded or interacted with via its device interface using a specific IOCTL (0x222024). This driver is known to be abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software processes from kernel mode, effectively bypassing Windows Protected Process Light (PPL) protections.
Detects evidence of the Alinubx.sys kernel driver being loaded or interacted with via its device interface using a specific IOCTL (0x222024). This driver is known to be abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software processes from kernel mode, effectively bypassing Windows Protected Process Light (PPL) protections.
Detects local privilege escalation attempts targeting Acronis backup plugins for cPanel, WHM, and Plesk. The rule monitors for instances where backup-related processes or binaries located within control panel paths are executed with root privileges when the parent process was not originated by root, a behavior indicative of exploiting insecure file permissions.
Detects the execution of a shell process (sh, bash, dash, zsh) spawned as a child of Acronis backup agent or plugin processes by the root user. This behavior is indicative of potential exploitation of local privilege escalation vulnerabilities, such as CVE-2026-87886, within Acronis backup plugins for cPanel, WHM, and Plesk.
Detects potential exploitation of CVE-2026-87886 in the Acronis Backup plugin for cPanel & WHM, where an adversary uses insecure file permissions to elevate privileges. The rule monitors for execution of file permission or ownership changing utilities (chmod, chown) targeting files associated with backup plugins.
This rule detects potential security software tampering by identifying the loading of a specific driver (Alinubx.sys) followed by the termination or interference of common security agent processes within a short timeframe. This behavior is indicative of an adversary attempting to disable endpoint protection using a Bring Your Own Vulnerable Driver (BYOVD) or malicious driver approach.
Detects anomalous staging activity associated with the 'PPPoEject' exploit. The rule identifies the creation of GRE or IP6GRE interfaces on bonding devices immediately preceding or concurrent with FUSE filesystem mounting or I/O activity. This pattern matches the exploitation workflow of racing pppoe_sendmsg() skb reallocation via dev_hard_header() to achieve privilege escalation.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
Detects high-frequency SCTP ASCONF/ADD-IP chunk packets originating from external networks. This behavior is indicative of a Denial-of-Service (DoS) exploit attempt targeting a vulnerability (CVE-2026-74469) related to DiagSpill transport_count integer wraparound.
Detects potential local privilege escalation via Windows ALPC (Advanced Local Procedure Call) heap-based buffer overflow by identifying a non-SYSTEM Chrome process tree spawning child processes with SYSTEM privileges. The rule specifically monitors for suspicious child binaries or paths characteristic of exploit payloads while excluding legitimate Chrome update and crash handler processes.
Detects unauthorized file write operations performed by ScreenConnect client or service processes into client/transfer directories. This activity is indicative of exploitation attempts, specifically CVE-2026-84869, which allows for unauthorized file transfers and potential remote code execution via active ScreenConnect sessions without user confirmation.
Detects anomalous MS_T120 channel binding and MCS handshake patterns characteristic of the BlueKeep (CVE-2019-0708) remote code execution vulnerability in Microsoft RDP services.
Detects the loading of the Alinubx.sys (aka CcProtect.sys) kernel driver, often dropped as nvfsflt64.sys or registered as NvFsFilter, followed by a rapid, simultaneous termination of security product processes. This activity is indicative of a BYOVD (Bring Your Own Vulnerable Driver) attack chain where kernel-mode primitives are used to terminate EDR/AV processes.
Detects the presence of the known vulnerable gdrv.sys driver on disk. This driver is frequently utilized in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-mode access, which is often leveraged to disable endpoint security products or escalate privileges.
Page 5 of 45