Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects anomalous process execution where a non-privileged process spawns a child process with root/SYSTEM (uid 0) privileges without passing through recognized elevation binaries (e.g., sudo, su, pkexec). This behavior is consistent with post-exploitation privilege escalation techniques, such as exploiting hijacked file descriptors or callback structures to gain root authority.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
This rule detects kernel crash signatures (e.g., use-after-free, kernel panic) in the pppoe module, correlated with preceding anomalous activity related to PPPoEject or PPPoE socket manipulation. It identifies potential exploitation of CVE-2026-68121 on non-gateway devices.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
Detects a suspected exploitation attempt of CVE-2026-81000, known as TUNderflow. The detection looks for a sequence of events where a process initializes a user namespace (unshare) followed by a kernel panic or error report from the tun/tap driver originating from the same process lineage within a short timeframe, which is indicative of an integer overflow exploit leading to kernel instability.
This rule detects kernel-level stability issues or crashes (ah6/ipsec related) occurring immediately after the execution of processes that create new user namespaces (unshare, clone with CLONE_NEWUSER). This pattern is often associated with exploitation of kernel vulnerabilities, where namespace manipulation is a prerequisite for triggering a crash or privilege escalation.
Detects high-frequency SCTP ASCONF/ADD-IP chunk packets originating from external networks. This behavior is indicative of a Denial-of-Service (DoS) exploit attempt targeting a vulnerability (CVE-2026-74469) related to DiagSpill transport_count integer wraparound.
Detects high-frequency SCTP ASCONF/ADD-IP chunk packets originating from external networks. This behavior is indicative of a Denial-of-Service (DoS) exploit attempt targeting a vulnerability (CVE-2026-74469) related to DiagSpill transport_count integer wraparound.
Detects high-frequency SCTP ASCONF/ADD-IP chunk packets originating from external networks. This behavior is indicative of a Denial-of-Service (DoS) exploit attempt targeting a vulnerability (CVE-2026-74469) related to DiagSpill transport_count integer wraparound.
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
This rule identifies Linux devices running kernel versions susceptible to the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill vulnerabilities. It parses the kernel version from the OSBuild information and flags devices falling below the specific patched versions (5.10.270, 6.1.188, 6.6.157, 7.2.4).
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects the execution of the Linux 'unshare' utility to create new namespaces (user or network). This command is often used as a primitive for container escapes or privilege escalation by allowing an unprivileged user to create isolated environments. The rule excludes common container management and virtualization tools to reduce noise.
Detects potential local privilege escalation (LPE) to root via an unshare invocation, tracking the process lineage from an unprivileged unshare execution to the subsequent spawning of a root-privileged shell within a short time window. This pattern is characteristic of various Linux kernel vulnerability exploits such as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, where the unshare system call is abused to enter new user namespaces to bypass security restrictions.
Page 7 of 45