Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
105 detections
Filters
Last updated
All Time
Detection languages
50
18
11
8
5
Contributors
26
25
13
10
6
Categories
56
32
31
24
19
Platforms
57
47
6
3
1
Products / Services
29
16
15
11
7
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
5
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects the loading of system drivers (.sys files) that are either unsigned or have an invalid digital signature. The rule excludes drivers loaded from common Windows system directories to minimize noise. This behavior is a common indicator of rootkit installation or the use of vulnerable drivers for kernel-mode exploitation.
This rule detects potentially malicious behavior associated with driver and inter-process communication, specifically targeting the creation or interaction with 'C:\ProgramData\402.sys', usage of IOCTL control code '2248E0', or activity involving the 'NSecKrnl' named pipe. These indicators are often associated with rootkit-like persistence or kernel-mode communication used by malware.
This rule detects command line activity associated with the exploitation of a Linux kernel vulnerability involving packet editing (often referred to as the 'pedit' or 'act_pedit' vulnerability). It monitors for the execution of exploit-specific binaries, kernel module loading of 'act_pedit', use of 'unshare' for namespace abuse, and configuration of 'tc' (traffic control) filters related to the exploit.
Detects suspicious process execution patterns associated with the exploitation of CVE-2026-46300 (Fragnesia). The rule monitors for the combination of user namespace creation via unshare, network tunnel configuration via ip, and kernel module loading related to ESP or rxrpc, which are indicative of an attempt to trigger a privilege escalation vulnerability in the Linux kernel.
Detects potentially unauthorized or malicious loading of kernel modules on FreeBSD systems using the kldload command. The rule identifies suspicious activity by flagging modules loaded from non-standard directories, kldload processes spawned by untrusted parent processes (like web servers, shells, or scripts), and instances where the process was invoked with sudo/su by non-root users.
This rule detects suspicious activity patterns on Linux systems that may indicate privilege escalation or container escape attempts. It monitors three main behaviors: the execution of network configuration tools (tc, insmod, modprobe) for kernel-level manipulations (pedit/actions), the use of 'unshare' to create isolated namespaces, and typical privilege escalation commands (su, id, whoami, bash) executed by non-root users. The rule correlates these events and alerts based on the combination and intensity of these behaviors, flagging high-severity activity when kernel-level tools are combined with namespace manipulation or privilege elevation.
Detects the exploit chain for CVE-2026-43503, an unprivileged kernel exploitation vulnerability. The rule identifies the creation of user and network namespaces by non-root users, followed by the manipulation of XFRM states or policies, and the subsequent loading of ESP kernel modules, which together facilitate privilege escalation.
This rule detects potentially malicious command-line arguments used with common Linux utilities. It monitors for: the use of 'unshare' for namespace manipulation often used for privilege escalation or container escapes, the 'ip xfrm' command for configuring IPsec policies, and the loading of kernel modules ('modprobe'/'insmod') with suspicious parameters ('esp4', 'esp6', 'rxrpc') which could indicate the installation of malicious rootkits or kernel-level backdoors.
This rule detects potentially malicious Android applications masquerading as security updates that request 'Device Administrator' permissions. Such apps often attempt to gain elevated privileges to maintain persistence, prevent uninstallation, or perform unauthorized administrative actions on the device.
Detects execution of Linux Traffic Control (tc) commands, module loading, or specific strings related to the exploitation of CVE-2026-46331, involving the act_pedit kernel component. These activities are associated with a potential kernel-level copy-on-write (COW) page cache corruption vulnerability that could be used for privilege escalation.
Detects the deployment, registration, and loading of known vulnerable drivers (e.g., mhyprot2.sys, gdrv.sys, rtcore64.sys) used in Bring Your Own Vulnerable Driver (BYOVD) attacks. This rule monitors file creation, module loading, service registration via sc.exe, and registry modifications associated with service installation.
Detects installation of rootkit kernel modules for deep system hiding
Detects attempts to unload, disable, or remove kernel drivers, which could indicate a rootkit or other malicious activity trying to hide its presence or impair system defenses. The rule specifically looks for process creation events (EventID 4688) where the command line contains keywords related to driver manipulation ('unload driver', 'disable driver', 'remove driver') and also references kernel components ('.sys', 'kernel').
Detects installation of rootkit kernel modules for deep system hiding
Detects attempts to unload, disable, or remove kernel drivers, which could indicate a rootkit or other malicious activity trying to hide its presence or impair system defenses. The rule specifically looks for process creation events (EventID 4688) where the command line contains keywords related to driver manipulation ('unload driver', 'disable driver', 'remove driver') and also references kernel components ('.sys', 'kernel').
Detects loading of kernel modules for deep system persistence
This rule detects the delivery of potentially malicious kernel modules or extensions over HTTP. It specifically looks for HTTP responses containing files with '.ko' (Linux kernel object) or '.kext' (macOS kernel extension) file extensions in the URI, indicating a client is downloading such a file. The 'flow:to_client,established' ensures the detection occurs on files being sent from a server to a client over an established HTTP connection.
Detects process creations (EventID 4688) where the command line contains keywords indicative of loading or installing kernel modules or drivers. This activity can be associated with privilege escalation or persistence techniques used by adversaries.
Detects the creation or modification of .plist files on macOS systems. This activity can be indicative of various malicious behaviors, particularly those related to persistence or privilege escalation, as .plist files are often used to configure application settings, launch agents, or other system behaviors.
Identifies the loading of a Linux kernel module from a suspicious, non-standard directory such as /tmp, /dev/shm, /var/tmp, or a user's local hidden directory. Attackers often deploy rootkits and other kernel-level malware from these locations to evade detection and gain persistence. This technique is a prerequisite for kernel-level bypasses like those used by the 'Singularity' rootkit.
Detects the use of non-standard kill signals (-900, -901) used to manage the ShadowGuard eBPF rootkit's process allow-list. This activity is associated with the TGR-STA-1030 threat actor.
Page 4 of 5